I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't matter"?
I am interested in the security of the password regarding cracking it only.
Not if it can cause a DoS overload the servers while hashing, or if the vendor thinks otherwise.
Also assume the password does not contain any dictionary it'd be in comments anyway. words, is stored using best practices, has a strong and unique saltunique salt, and relevant entropy per character. How the user will remember / recall / store the password also doesn't matter.
I agree that longerlonger / passwordspasswords / are saferare safer. I'm asking about the upper limit.
Is there a length (or entropy size) where making the password longer no longer (sic) matter, or even weakens its security? I know it depends on the hashing algorithm, if the upper limit for a given algorithm exists and is known, what is it?