@romin @Suiseiseki @sun

> you can't do that, you need to normalize the unicode string first,

I put control characters in some of my passwords. I would be pissed if something tried to normalize it to UTF-8. It is a bytestring, you reduce the entropy if you normalize it, and hash functions don't care.