Maximum password length in PBKDF2 Haven't found any clear cut answer in Google so its up to you guys:

DK = PBKDF2(PRF, Password, Salt, c, dkLen)


Here, what is the upper limit of password length? I tried up to 16 characters and it works. How far can I go? I read somewhere that salt has no upper limit! Is it really true?
There's no practical limit to password or salt length you can use with PBKDF2.

Theoretical limit, however, is determined by the hash function used by PBKDF2: under the hood, it uses $HMAC(Password, Salt || Counter)$, which in turn will translates to a series of hash function calls:


$K_0 = H(Password)$ (assuming password is longer than hash block)   
$HMAC = H((K_0 \oplus opad) || H((K_0 \oplus ipad) || Salt))$  


If we assume a very long password and/or salt, then two hash function calls can potentially "overflow": $H(Password)$ and $H((K_0 \oplus ipad) || Salt)$. To avoid such "overflow" $Password$ must be smaller than maximum input size supported by the hash function, and $Salt$ must be shorter than maximum input length minus block size of the function.

TO give some perspective and show why this doesn't really matters in real world, maximum input length for e.g. SHA-1 is $2^{64}-1$ bits or $2^{61}-1$ bytes. Block size of SHA-1 is 64 bytes, so maximum $Salt$ size will be $2^{61}-65$ bytes.