It generally means that yes. But sometimes it also has to do with CSR calls. eg, by not allowing spaces in passwords, you eliminate an entire class of PEBKAC er

It generally means that yes. But sometimes it also has to do with CSR calls. eg, by not allowing spaces in passwords, you eliminate an entire class of PEBKAC errors. I don't for a second believe that's why my.equifax.com is doing it. It's certainly not why there's a 20 character limit. (I personally use 64 char passwords wherever such long ones are allowed.)