The text as typed, unhashed, and never longer than bcrypt reads.
The text as typed, unhashed, and never longer than bcrypt reads.
The 72 byte refusal lives on this side as well as on Password's, because a login form decodes to a Plain and a text bcrypt cannot read cannot match any stored hash. Refusing it here says so, where letting it through would answer "wrong password" to a user whose password is right and merely long.
