Articles

Security

Where the safe-looking default is not safe — limits, silent truncation and the assumptions that only break in production.

bcrypt Stops Reading at 72 Bytes and Does Not Tell You
Two passwords that look nothing alike can be the same password. The cut is measured in bytes, not characters, so it lands mid-character — and 24 Chinese characters is already the whole budget.
August 7, 2026