It's because the internet is full of monkeys: http://security.stackexchange.com/questions/33470/what-technical-reasons-are-there-to-have-low-maximum-password-le

It's because the internet is full of monkeys: http://security.stackexchange.com/questions/33470/what-technical-reasons-are-there-to-have-low-maximum-password-lengths http://security.stackexchange.com/questions/33470/what-techn... > Originally, some developer, somewhere, was working on an old Unix system from the previous century, which used the old DES-based "crypt", actually a password hashing function derived from the DES block cipher. In that hashing function, only the first eight characters of the password are used (and only the low 7 bits of each character, as well). Subsequent characters are ignored. That's the banana.