It's fairly common to copy a large amount of text and drop it into an input with length restrictions. For instance, I do it often when I submit HN titles. For

It's fairly common to copy a large amount of text and drop it into an input with length restrictions. For instance, I do it often when I submit HN titles. For regular text, it's a much better UX to be able to paste the whole thing then edit it down to meet the restrictions than to paste and have it auto-truncated. When it comes to password inputs, where you can't necessarily see what you're pasting, it's extremely important than the user knows when truncation occurs. But could that be achieved while still respecting maxlength? Yes, I think it would be decent UX to alert the user when they attempt to paste text that exceeds the maxlength, without actually completing the paste. That way, the input remains empty so there's no confusion about whether the full password or a truncated password has been entered, and the user can take appropriate action.