TYPO3 Core

This sounds fishy: Core never stores passwords as plain text, its always hashed and currently provided and supported hash algos don't need more than 100 chars.

If you hacked your instance and disabled password hashes to store plaintext passwords: Stop doing this! This is a critical security issue as soon as an attacker manages to retrieve a password through for instance an sql injection or some other attack vector like a not properly secured db.

I do not hack my instances or disable hashing, please come down. maybe my description above is not clear. it is specifically about creating a fe-user via the backend. no password longer than 100 characters can be entered in the backend fe-user password field.

Patrick Lenk wrote:

In TYPO3 11 LTS the fe_users password database field is varchar(100), which is to small if the user want to use a password from e.g. a passwort manager with size of 128.
The field should also be changed to varchar(255) as in TYPO3 12 LTS.

My original description was wrong and misleading. the database field is not relevant here, but the config of the fe-user password field in the TCA, which is limited to 100.

The described change will most likely not make it into v11. Please increase the value to 255 with $GLOBALS['TCA']['fe_users']['columns']['password']['config']['max'] = 255; defined in Configuration/TCA/Overrides/fe_users.php in your sitepackage.