bcrypt’s 72-byte limit and Korean passwords

Character count differs from byte count. ASCII letters usually use one UTF-8 byte; Korean syllables usually use three. Equal visible lengths can therefore require different byte lengths.

This tool rejects inputs longer than 72 UTF-8 bytes instead of silently truncating them. Hashing the same password twice normally produces different strings because a fresh random salt is used each time.

Use bcrypt verification rather than comparing a newly generated hash directly with the stored string. Higher cost factors increase processing time, so choose them with the service’s actual performance requirements in mind.