htpasswd limits on username and pass length

Forum Moderators: phranque

Message Too Old, No Replies

htpasswd limits on username and pass length

spinnercee

3:18 pm on Mar 16, 2007 (gmt 0)

Hopefully this is s simple question.

What are the length limits on usernames and psasswords entered via the Apache htpasswd app.?

I ask this because I created a really long password for one account that would not work (authenticate) until I shortened it -- I could probably try a million different length combinations, but if anyone knows for sure...

jdMorgan

3:51 pm on Mar 16, 2007 (gmt 0)

The shortest limit I've seen is 12 characters.

Jim

spinnercee

6:20 pm on Mar 17, 2007 (gmt 0)

Thanks JD, here's what I found through very little non-scientific trial and error...

15 chars seems to be the limit for the password (MD5), and there seems to be no real limit on the username as it appears in plain text in the file.

This is using htpasswd.exe -b from Apache HTTPd v1.3.9 (Win32) in a command prompt (CMD.exe) on WinXP/Home/SP1.

Does that seem right? I'll do some more hacking around and see what I find out.

coopster

11:28 pm on Mar 17, 2007 (gmt 0)

Any passwords over 8 characters in length may not work as you expect. A related thread in which one member once asked about a possible htpasswd bug? [webmasterworld.com]