dcodeIO / bcrypt.js

Optimized bcrypt in plain JavaScript with zero dependencies.
Other
3.47k stars 264 forks source link

Exact password length in Javascript comparison #93

Open lucasMontenegro opened 5 years ago

lucasMontenegro commented 5 years ago

In the README you say that the bcrypt algorithm only works with passwords that are up to 72 bytes long. And in this stack overflow question I read that in JS a string is a finite ordered sequence of zero or more 16-bit unsigned integer values. If those 72 bytes are 8-bit long does this mean that in my code I have to check password.length > 36? Bcryptjs doesn't seem to care.