> Truncation to 16 characters is to appease stupid websites that limit passwords to 20 characters. This is something that drives me up the wall. I understand t

> Truncation to 16 characters is to appease stupid websites that limit passwords to 20 characters. This is something that drives me up the wall. I understand that you have to impose some kind of limit on password length to avoid abuse, but there's virtually no reason to cap it at anything less than 32 characters. I think a cap of 128 characters is completely reasonable and likely to appease even the most paranoid of users-- it all hashes to the same size anyway. Another thing that irritates me is when registration forms enforce max password length via javascript or maxLength, without describing the max length in writing somewhere on the page. If I generate a password and I paste it into that field, I have no way of knowing if it has been truncated or not. I can't count how many times I've registered for a website and then had to immediately recover the password because of this. The time that stands out most to me is when this happened with my bank! Come on! Pro-tip to any web developers out there: providing some kind of visual cue that the password I've entered is at the maximum length of the field (and that it was possibly truncated) is a good solution to an edge case that I feel is rarely considered.