Why does Laravel offer a max password length rule?

Passwords get hashed to a fixed length, so why does Laravel let you cap how long a password can be?

In today's video, I run a quick Tinker demo that exposes a surprising bcrypt behavior which makes it clear why having a maximum length for passwords makes sense.

Watch Now (6 min)

And after watching, don't forget to subscribe to our YouTube channel, so you don't miss future videos.

Here to help,

Joel

P.S. Surprises like this are why we publish the free Laravel security book.