Document storage requirements about passwordhash2 HOT 2 CLOSED

I'll make some docs. However, just the bcrypt hashes have a fixed size: 80 - full base64 encoded, 60 - crypt scheme hash, 55 - my short hash implementation expandable to the crypt scheme. The SHA2 schemes have a variable length given by the rounds parameter. Unless you won't go over an order of ten (such as from 5000 to 10000 - an extra char) everything will be OK from the DB point of view. Or you may leave some room, just to be on the safe side when doing adaptive hashing.

Later Edit: the short hash representation of SHA2 uses base36 encoding for the rounds parameter, therefore the hash length increases slower than using the base10 representation.

from passwordhash2.

Yea I knew the sha algos had no fixed length. I did have a quick look at the implementation and saw

<?php
$length = strlen((string) $cost) - 4;
$length = self::$map[$algo]['min_length'] + $length;

With $cost being 999999999 at max, I figured the max length would be min_length + 5.
So 75+5=80 for sha256 and 118+5=123 for sha512. Guess I should have looked a bit closer to take the base64 encoding into account.

Thanks for writing up the docs.

from passwordhash2.