> Even if they let me use a thousand characters that's just going to get hashed to the same length anyway, right? That assumes they're not storing your passwor

> Even if they let me use a thousand characters that's just going to get hashed to the same length anyway, right? That assumes they're not storing your password in a VARCHAR(16) field, which is what I always assume when I see a max password length restriction like this. Or perhaps they're using the ridiculous LANMan hash algorithm [1]. [1]: https://en.wikipedia.org/wiki/LAN_Manager#LM_hash_details https://en.wikipedia.org/wiki/LAN_Manager#LM_hash_details