> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Limiting bcrypt Passwords to 72 Bytes!
- URL: https://securinglaravel.com/security-tip-limiting-bcrypt-passwords-to-72-bytes/
- Published: 2025-03-11T07:46:37.000Z
- Updated: 2025-03-11T07:46:37.000Z
- Description: [Tip #106] Laravel 12 gives us the ability to reject passwords longer than 72 bytes for bcrypt, but you need to turn it on manually. Oh, and don't forget to add a validation rule, or you'll be throwing suspicious 500 server errors! 😱
- Author: Stephen Rees-Carter
- Tags: Security Tips, Laravel 12, Cryptography, Hashing

As we did when [Laravel 11 came out](https://securinglaravel.com/tag/laravel-11/) a year ago, we'll be spending the next couple of weeks looking at the security-related changes and improvements in [Laravel 12](https://securinglaravel.com/tag/laravel-12/). 

The first change I want to focus on relates to a Security Tip we had a couple of weeks ago: [Should You Limit Password Lengths?](https://securinglaravel.com/security-tip-should-you-limit-password-lengths/)

My conclusion in that tip was that there isn't a compelling reason to limit password lengths when using bcrypt, but the reverse is true too, there isn't a good reason not to limit lengths. So we left it hanging and moved on.

However, [Alan Cole](https://alancole.io/?ref=securinglaravel.com) decided it was worth doing something about. 

[In his words](https://github.com/laravel/framework/pull/54494?ref=securinglaravel.com#issuecomment-2641780949):

> Yes it's not unique to PHP, but lots of libraries (in other languages) do add the additional check on top of the system implementation, because frankly why not?  
>  
> Laravel is a "Batteries Included" framework, and if we can do things that help developers make safer tools, I think we should. A check as simple and low rent as this just seems like such a no brainer.

He then created a [PR for Laravel 12](https://github.com/laravel/framework/pull/54509?ref=securinglaravel.com) that modifies the bcrypt hasher to check if the password is longer than 72 bytes (using `strlen()`), and throws an exception if the password is too long. 

The feature has changed slightly since the PR was merged, so it's now disabled by default, plus you need to specify the length limit for the password (even though it's always going to be 72).

To enable it in your apps, you can either set `BCRYPT_LIMIT=72` in your `.env` or set the `bcrypt.limit` to `72` in your `config/hashing.php`:

```
'bcrypt' => [
    'rounds' => env('BCRYPT_ROUNDS', 12),
    'verify' => env('HASH_VERIFY', true),
    'limit' => env('BCRYPT_LIMIT', 72),
],
```

config/hashing.php

Once enabled, it'll prevent passwords longer than 72 bytes from being hashed and stored, throwing an `InvalidArgumentException` when they are hashed. 

This should avoid potential password-length issues in the future by preventing overly long passwords aren't accepted.

💡

While this won't affect any existing stored passwords that are longer than 72 bytes (it only hashes new passwords), it will apply if a password needs to be rehashed on login - such as when you change your bcrypt work factor, which we did in Laravel 10\. In this situation, a user attempting to login with a 72+ byte password will likely be locked out of their account by a `500 Server Error`!

This is where the PR leaves it, however I would recommend taking it a step further and enabling max length validation rules on your password-related forms. This new limit only throws an exception, so a user submitting a long passwords will hit a `500 Server Error`, with no useful feedback as to why. Adding some validation tells the user **why** their super-long password isn't working.

That said, Laravel's `max` validator uses `mb_strlen()` which counts characters, while this limit (and bcrypt) is limited to **72 bytes.**

For example:

```
> strlen('😈😈😈😈😈😈😈😈😈😈😈😈😈😈😈😈😈😈😈😈');
= 80

> mb_strlen('😈😈😈😈😈😈😈😈😈😈😈😈😈😈😈😈😈😈😈😈');
= 20
```

This can create a potential issue where a password that uses multi-byte characters will pass validation, but still throw the exception when it hits the hasher.

As far as I know, there isn't currently a solution in Laravel for this directly. You will need to implement your own validation rule that uses `strlen()` to properly validate password lengths and provide useful feedback to your users.

🤓

It's worth noting that hackers always pay attention to `500` errors, as they indicate the server wasn't expecting the input. This often indicates potential [SQL Injection](https://securinglaravel.com/tag/sqli/) issues, and when thrown on password inputs, it usually indicates terrible password handling! 

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* 

*You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*