Squid Passwords and the Eight-Character DES crypt Limit
Trace apparent password truncation to the stored hash format before blaming Squid or silently regenerating an incompatible password file.
A proxy accepts an old password when its ending changes, or a password-file migration suddenly breaks accounts with long passwords. Inspect the hash format before shortening everyone's passwords.
Apache's htpasswd -d selects legacy crypt() hashing. Its documented DES limitation is eight significant password characters. That limitation belongs to the format, not to a universal eight-character password rule in Squid.
The NCSA helper reads the stored password representation and verifies the supplied value using the formats supported by that helper and its platform. Calling a file “htpasswd format” does not guarantee that every historical and current helper accepts every hash algorithm produced by every htpasswd option.
Migrate the representation deliberately
Keep a protected backup and identify the format used by existing entries. Check the installed helper's manual and distribution build before choosing the replacement algorithm.
Then verify a small approved test account through the same helper and proxy path the real accounts use. A generator writing a file successfully does not establish that the consuming helper can validate it. Use a test password whose significant characters extend beyond the old boundary.
Changing formats normally requires the actual password or a password reset. A legacy hash cannot be transformed into a stronger hash of the full original password when that information was never retained.
Finally, distinguish migration failure from cached authentication. An already authenticated client may continue to work for a while even when a new validation would fail. Plan the rollout around fresh authentication as well as existing sessions.
Do not publish the password file in a bug report. The algorithm marker and a synthetic account usually provide more useful evidence than real users' hashes.