Consistency for the user is also important. If your login processing code does more work than your password-setting code, load limits may allow a password to b

Consistency for the user is also important. If your login processing code does more work than your password-setting code, load limits may allow a password to be set that then can’t be used for login. A length limit acts like a fuse, ensuring that under load it’s the thing that breaks first and in a predictable way.