Is there a maximum length to user passwords?

Question

In the database, the hashed password is stored in a field that can store up to 60 characters.

My question: is there an upper character limit on the unhashed (user-chosen) passwords, or will the hashing procedure always keep it below a certain length? - (Eg. how strictly should I validate its length upon registration?)

Edit:

Based on the article linked by Dave White, I've tried setting an 1001 character length password, just to see if it's possible. Although it almost froze the admin panel, but set it successfully, and login was possible.

Looks like the hasing algorithm shortens even the longest of passwords to a certain length, but I would like to hear confirmation from people more knowledgable in cryptography.

Answer 1

From WordPress Tavern - the article is for WordPress password-protected posts but the final paragraph reads:

This update only affects password-protected posts. WordPress user passwords don’t share the same length restrictions and can be upwards of 1,000 characters long if so desired.

Answer 2

The upper limit for password length in WordPress is 4096 characters bytes, at present. This has been the case since 2014.

If WordPress eventually switches to using the built in PHP password_hash mechanism, then the length limit on the password will be 72 characters. Or rather, the password_hash function truncates passwords to that length.