stretches or cost is number of hashing rounds, so not related to password length. bcrypt has 72 bytes password length limit [0]. If the password is shorter, it

stretches or cost is number of hashing rounds, so not related to password length. bcrypt has 72 bytes password length limit [0]. If the password is shorter, it gets extended to 72 bytes anyways, so longer passwords (10 chars vs 70 chars) are not making time difference. The password can be pre-hashed to allow arbitrary sized passwords [1], but I don't think 10 chars vs 10000 would make a significant difference. I think most of the time will be spent on bcrypt rounds, not on pre-hashing. > Happened to me. While trying to find stretches quote, I found this post [2], so maybe it was not bcrypt? :) [0] https://en.wikipedia.org/wiki/Bcrypt#Maximum_password_length https://en.wikipedia.org/wiki/Bcrypt#Maximum_password_length [1] https://en.wikipedia.org/wiki/Bcrypt#Solution_3_-_Pre-hash_password https://en.wikipedia.org/wiki/Bcrypt#Solution_3_-_Pre-hash_p... [2] https://news.ycombinator.com/item?id=26270129 https://news.ycombinator.com/item?id=26270129