At least they tell you. I signed up with websites that just cut the password after the 12th character. No way of signing in with the password again (not without trying a couple of times, at least)

when you varchar(24) and forget about the hash

One of the accounts that I have to use at my job is like this but much much worse. It only accepts letters and numbers, no capitalization, no symbols and can only be 8 digits long maximum. It's like they want to account to be easy to compromise.

I once registered an account with a random ~25 characters long password (Keepass PM) for buying tickets on https://uhuu.com.br/

The website allowed me to create the account just fine, but once I verified my e-mail, I couldn't log into it due to there being a character limit ONLY IN THE LOGIN PASSWORD FIELD. Atrocious.

EDIT: btw, the character limit was 12

I like it that the site says the max length....this is not common. I wish it was.

At least they tell you. I’ve had inputs take the full password and then truncate it silently, so you don’t actually know what they saved. Then, you try to login and they tell you wrong password.

We have a customer, a big international corporation, that has very specific rules for their intranet passwords:

• Must contain letters
• Must contain numbers
• Must contain special characters
• No repeats
• Passwords must be changed every two months
• Not the same password as any of the last seven
• PASSWORDS MUST BE EXACTLY EIGHT CHARACTERS LONG

I can only assume that whoever came up with these rules is either an especially demented BofH, or they have some really really weird legacy infrastructure to deal with.

i once used 20 for a bank. the website havent told me it was too long just clipped off 2 and accepted the rest. not even the banking support was able to help me. took me a few days to solve this by accident.

The password should be hashed anyway, which has a fixed output

What’s more frustrating is when the password creation page is silently cutting off too long passwords and don’t inform you about it.

Some people even suggest typing a longer password over a simpler one with more special characters. It's harder to brute force.

I don't have it in me

Don’t worry, pretty soon they will just block password managers from autofilling fields on their login page so that you HAVE to remember your password! Then you’ll be happy it can’t be that long, you can only fit so much on a post-it note on the side of your monitor

/s

EDIT: I think there should be a law against blocking password managers for filling in fields. Any brute force bots are going to submit HTTP requests directly anyway; no one is hitting the DOM to do that

I've had a case in the past where I reduced my password to the limit, but after account creation, I was not able to log in.

Turns out they had an off-by-one issue, and a password with a length slightly below the limit worked fine.