I think that method was just added in response to this vulnerability:
https://github.com/django/django/commit/aae5a96d5754ad34e48b...
https://github.com/django/django/commit/aae5a96d5754ad34e48b...
You can see that clearly in the test suite, where the input of KDFs are byte objects:
self.assertRaises(
ValueError,
make_password,
b"1" * (MAXIMUM_PASSWORD_LENGTH + 1),
"seasalt",
"md5",
)
because the number of code units is at most the number of input bytes (with fixed-width 8-bit encodings), KDFs will be the limiting factor and the limit is thus 4096 bytes.[0] https://docs.djangoproject.com/en/dev/ref/unicode/#models
> model fields that are character based (CharField, TextField, URLField, etc) will contain Unicode