An arbitrary, short, upper limit is also an externally detectable code smell of a site that potentially stores passwords in plain text. If the passwords were s

An arbitrary, short, upper limit is also an externally detectable code smell of a site that potentially stores passwords in plain text. If the passwords were salted and hashed (preferably with a KDF) then the output of the salt and hash stage would be a fixed length value, independent of password input size, making external, small, limits of maximum length unnecessary. Instead, a statement of "maximum of X" where X is small like 16 or 20 or some other number implies that the storage for the password is a char(16) or char(20) column. Which also implies plain text storage.