You can DOS a site that doesn't have password length enforcement. 20 characters really is too low though, because it rules out a lot of pass phrases. I believe

You can DOS a site that doesn't have password length enforcement. 20 characters really is too low though, because it rules out a lot of pass phrases. I believe Django allows up to 4mb for the password, which is more than enough for any sane password.