ASVS V6.2.9 requires that passwords of at least 64 characters are permitted. It is a Level 2 requirement.
Why it matters
Password managers and passphrase users create long secrets. A maximum of 16 or 20 characters throws away their strength and tells attackers something about how you store passwords.
A longer limit also helps the user who wants a sentence of several words. Four random words easily reach 25 to 30 characters, and sentences go well beyond that. Telling users to shorten their phrase makes them pick something weaker.
How to implement it
Pick a generous maximum, such as 128 characters, mainly to stop someone submitting megabytes to burn CPU in the hash function. Enforce it before hashing, and make sure no other layer shortens the value: database column, web framework form limit, proxy body limit.
-- store the hash, never the password
password_hash VARCHAR(255) NOT NULL
const MAX = 128;
if (pw.length > MAX) return res.status(422).json({ error: "Password is too long (max 128)." });
How to test it
Register with a 64 character password and a 128 character password, then sign in with each. Both must succeed. A 129 character value should get a clear message, not a server error.
Check the full path: browser form, API gateway, application validator, hashing call and database. A limit in any one of them breaks the requirement even if the others are generous.
Common mistakes
-
A
VARCHAR(32)column holding a plaintext or truncated value. -
Frontend
maxlength="20"attributes left in place. -
Hash functions with input limits that truncate silently.
-
Mentioning the limit in an error message that reveals your hash algorithm or database design.
Quick check
Why set any maximum?
Hashing very large inputs costs CPU, so a bound protects the service. It just has to be well above 64.
