> but often the account creation page and login page have different behavior It's bad enough when that only applies to the length, but at least you could theor

> but often the account creation page and login page have different behavior It's bad enough when that only applies to the length, but at least you could theoretically still log in once you knew what length it was truncated to. I've seen at least one banking site which had a narrower set of permitted symbols on the login page than the new account page. (Specifically, the login page didn't allow parentheses, but the new account page did.) Entering the correct password resulted in a form validation error, and of course if those symbols were removed then you still couldn't log in because it wasn't the right password. Fortunately the login page's validation rules were all client-side, and thus easily bypassed via devtools with basic JS debugging techniques. Once logged in you could change your password to something the login page would accept without messing with the scripts.