Max length of the password/passphrase?

Hello Team,

Following this post:

I was interested to know 2 specific details.

  1. What is the max length that Cryptomator accept or read for a password or passphrase?
    (For example, Nextcloud 13 let you to enter whatever the length you want but read only the 72 characters)

  2. Does the fact to have a weak password at the beginning, and change it stronger later make a weak encryption for the “old files” (reference to the post above), or the fact that there is a KEK don’t change anything about the encryption itself?

Thanks :slight_smile:

There is no maximum length. The whole password will be passed to our KDF. That said, there is no security benefit of entering a password with more entropy than the 256 bit key that is used after key derivation, i.e. a hundred random ascii characters.

Please note, that when creating vaults with very long passwords the password strength indicator will no longer measure your password strength for passwords longer than 100 chars due to a fix for a former UI freeze.