There's basically a 0% chance that it is because they don't hash passwords and they're a limit on a table column or something. Paypal has faults, but they're no

There's basically a 0% chance that it is because they don't hash passwords and they're a limit on a table column or something. Paypal has faults, but they're not that incompetent. The more charitable logic for this policy goes like this: 1) for those who want security, 20 digits of random characters using a password manager is plenty 2) for those who actually remember and type a password (i.e., just a regular password), requiring them to keep it less than 20 characters increases the odds that they can actually type it in correctly (think elderly or more easily confused people here) and that reduces calls to customer service to complain that their password doesn't work. Reason #442 to use a password manager.