Usually it's about legacy compatibility. Some system somewhere makes some assumption, this system is hard to change so rather than attempting to change this sys

Usually it's about legacy compatibility. Some system somewhere makes some assumption, this system is hard to change so rather than attempting to change this system, other systems that interact with it have to adjust themselves, as they are easier to change. For me, restricting the length is a clear indication that they don't properly secure your password. It should be hashed to a consistent length regardless of the actual length of the clear-text, so it shouldn't matter, even for legacy reasons. If I see that, I know that unless the service is vital, try to find an alternative or be prepared for when they finally get broken into, one way or another. Overall their security tends to be weak if they pull stunts like that.