3 ms·
There is no good reason to limit passwords to 20 characters. If a site requires a limit so a user doesn't try to use the entirety of Don Quixote as a password,
by ChrisGranger 8y ago
There is no good reason to limit passwords to 20 characters. If a site requires a limit so a user doesn't try to use the entirety of Don Quixote as a password, it should still allow enough characters for a reasonably long passphrase, which should then be hashed.
- pwg 8y agoAn arbitrary, short, upper limit is also an externally detectable code smell of a site that potentially stores passwords in plain text. If the passwords were salted and hashed (preferably with a KDF) then the output of the salt and hash stage would be a fixed length value, independent of password input size, making external, small, limits of maximum length unnecessary. Instead, a statement of "maximum of X" where X is small like 16 or 20 or some other number implies that the storage for the password is a char(16) or char(20) column. Which also implies plain text storage.