>> Hey [bank], does that 16 character limit mean you've got a varchar(16) column somewhere and you're storing passwords as plain text? > As much as I don't bel

>> Hey [bank], does that 16 character limit mean you've got a varchar(16) column somewhere and you're storing passwords as plain text? > As much as I don't believe that's the case in any modern bank of significance, it's definitely not a good look. Inevitably the root cause in situations like this is "legacy" - there's some great hulking back-end banking solution the modern front-end needs to play nice with and the decisions of yesteryear are bubbling up to the surface. It's a reason, granted, but it's not a very good one for any organisation willing to make an investment to evolve things. But the only reason that "legacy" system would have a limit is because it's storing your password. So > I don't believe that's the case in any modern bank of significance It _is_ the case. It may not be the case in their most recent systems, but a chain is only as strong as it's weakest link. You can be hashing/salting the user's password and locking it behind a vault door to make sure noone can access it. But if you _also_ keep a copy of the password in plain text on a piece of paper taped to the outside door, the vault copy doesn't protect it.