Merge pull request #52 from pyca/alex-patch-2

Document that bcrypt doesn't handle long passwords

1 files changed, 15 insertions, 0 deletions

diff --git a/README.rst b/README.rst
index bd24e1b..2479dbb 100644
--- a/README.rst
+++ b/README.rst
@@ -84,6 +84,21 @@ Another one of bcrypt's features is an adjustable prefix to let you define what
 libraries you'll remain compatible with. To adjust this, pass either ``2a`` or
 ``2b`` (the default) to ``bcrypt.gensalt(prefix=b"2b")`` as a bytes object.
 
+Maxmimum Password Length
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+The bcrypt algorithm only handles passwords up to 72 characters, any characters
+beyond that are ignored. To work around this, a common approach is to hash a
+password with a cryptographic hash, such as ``sha512`` before hasing it with
+``bcrypt``:
+
+.. code:: pycon
+
+    >>> password = b"an incredibly long password" * 10
+    >>> hashed = bcrypt.hashpw(
+    ...     hashlib.sha512(password).digest(),
+    ...     bcrypt.gensalt()
+    ... )
 
 Compatibility
 -------------