I've met several (official or less of it) instances where my default 32 character passwords are not accepted. Usually the limit is 12, 16 or even 10. My guess i

I've met several (official or less of it) instances where my default 32 character passwords are not accepted. Usually the limit is 12, 16 or even 10. My guess is it is stored as a string in a database as a fixed length char field or legacy from the time it was stored that way. Surprisingly many webshops have a 16 char limit, suggesting they use the same backend. My bank used to have 12, but now it is at least over 32 combined with some form of 2FA. I've seen one instance where the password was "hashed" client side and the length thus didn't really matter, the implementation was lacking but they made an effort at least.