The thing I've always found concerning about sites disallowing certain special characters is that it makes you worry that they're doing something other than imm

The thing I've always found concerning about sites disallowing certain special characters is that it makes you worry that they're doing something other than immediately feeding the raw password bits into a password hashing algorithm. It's not that disallowing those characters will lead to more insecure passwords that worries me, it's that it indicates that the site is more likely to be making other mistakes that will allow my account to be compromised in some way that doesn't attack the strength of the password. The only reason I can fathom for disallowing certain characters is if they expect a use case where someone will be entering their password on equipment incapable of entering those characters. For example, let's say TSA's Global Entry program required people to authenticate as they're passing through customs. In that case, it would be perfectly reasonable to limit valid password characters to those that can be entered on the available keyboards. But those kinds of use cases are few and far between.