That's a bug. Bcrypt doesn't truncate, it simply doesn't handle longer passwords...

		Dylan16807 on Dec 2, 2014 \| parent \| context \| favorite \| on: “Invalid username or password” is a useless securi... That's a bug. Bcrypt doesn't truncate, it simply doesn't handle longer passwords. And you can pretty safely use another hash before feeding it into bcrypt.