The reason for the limit is actually quite stupid. PayPal does store the hashed version of your password as is required of any user database that is part of a p

The reason for the limit is actually quite stupid. PayPal does store the hashed version of your password as is required of any user database that is part of a payment processing system. However, because PayPal has been around so long your password is transmitted to the server using a two-way encrytion scheme so that the server side can consistently apply hashing without requiring client side code to do so which makes things much harder and requires more bandwidth to be delivered. Bandwidth concerns finanlly brings us to the reason that paypal limits the password size to 20. PayPal uses an authentication scheme that stores the encrypted password client side and requires it to be resent with every request (or at least used to). Because the password isn't hashed before being transmitted, and is present with every request, they limited the size. All of this was designed and implemented more than 10 years ago and even though both the bandwidth concerns and the need to send the password with every request are both outdated and paypal has likely updated to newer systems that remove these concerns entirely, companies rarely re-examine these kind of hard coded limitations unless they are legally required to.