The Bcrypt 72-Byte Limit: What Happens When Your Password Is Too Long

Bcrypt has a little-known limitation: it only processes the first 72 bytes of the input password. Anything beyond that is silently truncated. This means "password123" and "password123extracontent" produce the same hash. While this isn't a practical security issue for most applications, it's important to understand.

Handling the Limit

For most applications, 72 bytes (approximately 72 ASCII characters) is more than enough for a password. However, if your system allows passphrases or Unicode passwords (which use more bytes per character), you should pre-hash the password with SHA-256 before passing it to bcrypt. This ensures the full password contributes to the hash. Never tell users their password is too long — silently handle it with pre-hashing. A bcrypt generator tool should clearly document this limitation.

Why This Matters in 2026

Security vulnerabilities in authentication and cryptographic systems can lead to devastating data breaches. In 2026, the threat landscape has evolved — AI-assisted attacks, quantum computing concerns, and increasingly sophisticated supply chain attacks mean that developers can no longer treat security as an afterthought. Understanding the tools and practices that protect user data is essential for every developer, not just security specialists.

Key Takeaways

• Always use cryptographically strong algorithms — EdDSA for JWTs, Argon2id for passwords
• Set short expiration times on tokens — 15 minutes for access tokens is the 2026 standard
• Never store sensitive data in JWT payloads — they are encoded, not encrypted
• Store tokens in httpOnly Secure cookies, never in localStorage
• Validate all JWT claims — exp, iss, aud, nbf — not just the signature
• Use secret management services, never hardcode secrets in source code

Common Mistakes to Avoid

• Using alg:none in JWT verification — allows complete authentication bypass
• Storing JWTs in localStorage where XSS attacks can steal them
• Using MD5 or SHA-256 directly for password hashing — they are too fast
• Not setting expiration times on tokens, leaving them valid forever
• Using weak signing keys — less than 256 bits for HS256 is unacceptable
• Not validating the audience (aud) claim, allowing cross-service token reuse

Best Practices

• Use EdDSA (Ed25519) as the default algorithm for new JWT systems
• Use Argon2id with OWASP-recommended parameters for password hashing
• Keep access tokens short-lived (15 min) with refresh token rotation
• Store refresh tokens as opaque random bytes, hashed in the database
• Pin the algorithm in your verifier — never let the token choose
• Audit your authentication system quarterly for new vulnerabilities

Quick Reference

Here is a secure JWT verification pattern that pins the algorithm and validates all critical claims:

import jwt from "jsonwebtoken";

function verifyToken(token, publicKey) {
  try {
    const payload = jwt.verify(token, publicKey, {
      algorithms: ["EdDSA"], // Never let the token choose
n      issuer: "your-app",
      audience: "your-api",
    });
    return { valid: true, payload };
  } catch (e) {
    return { valid: false, error: e.message };
  }
}

Real-World Example

A real-world authentication flow using short-lived access tokens with refresh token rotation. This pattern limits the damage from compromised tokens while maintaining a smooth user experience:

// Login: issue access + refresh token
async function login(userId) {
  const accessToken = jwt.sign({ sub: userId }, privateKey, {
    algorithm: "EdDSA",
    expiresIn: "15m",
    issuer: "your-app",
  });
  const refreshToken = crypto.randomBytes(32).toString("hex");
  await storeRefreshToken(userId, hash(refreshToken));
  return { accessToken, refreshToken };
}

Tools and Resources

• DevKit JWT Decoder — inspect JWT header, payload, and claims client-side
• DevKit Hash Generator — generate SHA-256, SHA-512 hashes in the browser
• DevKit Bcrypt Generator — test bcrypt hashing with different cost factors
• OWASP Cheat Sheet Series — authoritative security best practices
• Have I Been Pwned — check if credentials have been in data breaches

"Security is not a product, but a process. It is not something you buy, it is something you practice."

Security requires constant vigilance. Use strong algorithms, keep tokens short-lived, validate every claim, and never trust unverified input. The tools are available — the discipline to use them consistently is what separates secure systems from vulnerable ones.