Cannot argue with that. It should be noted that 256 characters is our default across all inputs if no other maximum has been selected.<p>We could trivially increase it on passwords, but as you said, 256 is already higher than 99% of people use for a password and not at all unreasonable.<p>Allowing legitimately unlimited inputs could cause problems regardless of hashing, since our timeout (which is fairly long for other reasons) would ultimately be our only protection.<p>But if there was a request&#x2F;need&#x2F;complaint we would just double it and day to day likely wouldn&#x27;t notice a thing.