Are shorter password hashes safe? How much can I shorten a password hash before it begins to impact security?

Suppose that I use PBKDF2 (correctly salted) with HMAC-SHA256 as the PRF.  From what I've seen, it's typical to use 256 bits of output, since that matches what comes out of the PRF.

My intuition suggests that there would be no security impact if this output were truncated to 128 bits.  Is this correct?  My reasoning here is that salting prevents multi-target attacks, and that collisions are unimportant in the context of password verification.
My intuition suggests that there would be no security impact if this output were truncated to 128 bits. Is this correct? My reasoning here is that salting prevents multi-target attacks, and that collisions are unimportant in the context of password verification.


Correct, there is no practical security impact. The preimage security of the hash function is what matters for password hashing, and 128 bits is long enough to prevent brute force preimage search. You could probably even go shorter than that, but database space is usually cheap which is why using the full 256 bits is common.

In principle, with a 129+ bit entropy password you would lose some security, as a brute force attack to find some password with the same hash would become faster. Such passwords are very uncommon, however, and the brute force would remain infeasible even if theoretically faster.

(If SHA-256 is found to be very weak after some new attack all bets are off. The attack could allow a faster preimage attack on truncated output or it could not. The opposite could even be the case.)