This article[0] talks about why at least one company still has maximums. I too can relate to that, at my old job we had a 30 character hard limit because of int

This article[0] talks about why at least one company still has maximums. I too can relate to that, at my old job we had a 30 character hard limit because of interop with Oracle systems behind the scenes (we authenticated users twice, once in the web app which could have unlimited passwords stored as PBKDF2, and then again with an Oracle system that was hard restricted). A lot of businesses have backwards compatibility or proprietary systems in the way. [0] https://arstechnica.com/information-technology/2012/09/secret-microsoft-policy-limited-hotmail-passwords-to-16-characters/ https://arstechnica.com/information-technology/2012/09/secre...