My bank: β€œyour password is too long, please choose a new password.”

Should never be an error message, ever.

@nixCraft

I think it's reasonable to cap a password length at 128 or 256 characters.

That's not what they are doing... but I'd be OK if that's how high the number was.

@0xDEADKEITH @nixCraft If you're hashing passwords anyway, does it even matter? You don't store the password, you create a hash from the password and that can be as short as you like.