"Code points" isn't enough. Characters like ö can be represented in de-composed (¨+o) or composed (ö) form. Even Hangul supports decomposition. Unicode defines

"Code points" isn't enough. Characters like ö can be represented in de-composed (¨+o) or composed (ö) form. Even Hangul supports decomposition. Unicode defines rules you can implement to normalize these, but they change between Unicode versions and you can end up with a password that works in one Unicode version and not another.