There's no reasonable limit if the password is being properly hashed. Just whatever fits in a request, really. My fear and supposition is that someone's storin

There's no reasonable limit if the password is being properly hashed. Just whatever fits in a request, really. My fear and supposition is that someone's storing the password in cleartext in some ancient SQL database somewhere, or blindly working from design specs that assume that. There are some alternate, more charitable explanations, mostly to do with UI or UX, but none of those are particularly more encouraging.