I don't see any reason why we shouldn't allow longer passwords. Since we are hashing them, there is also no reason to limit it to some DB field. The hash always has identical length. So I'm going to set this to 512kb.

Stupid question, but: bcrypt runs inside of the PHP process, so it consumes the same memory as the original process. Considering that it is intended as a slow and memory intensive algorithm, would it make sense to have this limit lower in order to not run into memory issues? Like, shouldn't 8kb be good enough?