diff --git a/ext/standard/password.c b/ext/standard/password.c
index a28ceb7e0ced..a677cd7d85cb 100644
--- a/ext/standard/password.c
+++ b/ext/standard/password.c
@@ -184,6 +184,10 @@ static zend_string* php_password_bcrypt_hash(const zend_string *password, zend_a
 		return NULL;
 	}
 
+	if (ZSTR_LEN(password) > 72) {
+		zend_error(E_NOTICE, "Passwords longer than 72 characters are truncated by bcrypt");
+	}
+
 	if (options && (zcost = zend_hash_str_find(options, "cost", sizeof("cost")-1)) != NULL) {
 		cost = zval_get_long(zcost);
 	}
diff --git a/ext/standard/tests/password/bcrypt_72_char_limit.phpt b/ext/standard/tests/password/bcrypt_72_char_limit.phpt
new file mode 100644
index 000000000000..f716259e4b6a
--- /dev/null
+++ b/ext/standard/tests/password/bcrypt_72_char_limit.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Test 72 character limit of bcrypt
+--FILE--
+<?php
+$long_pass = str_repeat('a', 71);
+
+$hash = password_hash($long_pass . 'a', PASSWORD_BCRYPT, array("cost" => 4));
+var_dump(password_verify($long_pass . 'a', $hash));
+var_dump(password_verify($long_pass . 'b', $hash));
+
+$hash = password_hash($long_pass . 'aa', PASSWORD_BCRYPT, array("cost" => 4));
+var_dump(password_verify($long_pass . 'aa', $hash));
+
+echo "This is the unexpected behavior we warn about: password is different but password_verify returns true.\n";
+var_dump(password_verify($long_pass . 'ab', $hash));
+
+?>
+--EXPECTF--
+bool(true)
+bool(false)
+
+Notice: Passwords longer than 72 characters are truncated by bcrypt in %s on line %d
+bool(true)
+This is the unexpected behavior we warn about: password is different but password_verify returns true.
+bool(true)