I agree, though I also think: why have some arbitrary limit at all? Mind you the 4K Django limit isn't arbitrary, they know that at some point beyond that they'

I agree, though I also think: why have some arbitrary limit at all? Mind you the 4K Django limit isn't arbitrary, they know that at some point beyond that they'll spend too much time in hashing-land and will have opened up a DoS attack vector. I would argue 4K is effectively unlimited... maybe in the sense of an ISP/phone company "unlimited data plan" unlimited, but still... the likelihood of user knowing of the limit is very small. I use a password manager that maxes out at 100 characters in its password generator (a default I use because... why not?) However, in those small cases where I do use contrived passwords, I make use of passwords that are really pass-sentences (with a few extras thrown in). It's pretty easy for me to blow by 64 characters (and sometimes 100) in those cases; not because I think I'm gaining extra security due to length, but because I'm just throwing out the first, easiest to remember sentence that crosses my mind and that I know will be reasonably secure. A service that flummoxes that effort just makes it less likely I'll use the service (assuming that it's use is discretionary).