I once registered an account with a random ~25 characters long password (Keepass PM) for buying tickets on https://uhuu.com.br/

The website allowed me to create the account just fine, but once I verified my e-mail, I couldn't log into it due to there being a character limit ONLY IN THE LOGIN PASSWORD FIELD. Atrocious.

EDIT: btw, the character limit was 12

What’s more frustrating is when the password creation page is silently cutting off too long passwords and don’t inform you about it.

This shit pisses me off so bad. I had an identity theft a few years back, took ages to undo, and my credit score is still impacted by it. At the time I moved to a password manager and all my passwords are 31 characters of garbage. I’ve got several, highly sensitive accounts that my passwords don’t work for, in fact one a bank, until fairly recently, had repurposed a phone number field in the DB so passwords were limited to 10 characters numeric only (I managed to get one of their IT folks on the horn to explain why the password was so awful).

I cannot believe we live in 2025 and we still haven’t figured out passwords.

My worst experience so far was a webpage that trimmed passwords to 20 characters in length without telling you. Good luck logging in afterwards...

We have a customer, a big international corporation, that has very specific rules for their intranet passwords:

• Must contain letters
• Must contain numbers
• Must contain special characters
• No repeats
• Passwords must be changed every two months
• Not the same password as any of the last seven
• PASSWORDS MUST BE EXACTLY EIGHT CHARACTERS LONG

I can only assume that whoever came up with these rules is either an especially demented BofH, or they have some really really weird legacy infrastructure to deal with.

I've had a case in the past where I reduced my password to the limit, but after account creation, I was not able to log in.

Turns out they had an off-by-one issue, and a password with a length slightly below the limit worked fine.

Your password MUST contain big and small letters, and contain at least 1 number character and 1 spacial character, it MUST be 8 characters long, and it MUST be typed on a German Cherry keyboard between 8-9 PM, using ONLY 1 finger while blindfolded and listening to ABBA music. BUT NO SPACES ALLOWED!!!
This is because of something called entropy we never even read about so we have zero understanding of it. Of course combined with lousy programming, so safety is all on you.

Making all these possibilities OPTIONAL would actually make for safer passwords (higher entropy), as would using multiple words separated by spaces. The only meaningful way to accept a password would be to test it against common bad passwords, and test the entropy to determine acceptable levels. There is no good reason a password couldn't be 10 words and at least 127 characters. There is no way that should stress a properly designed modern system.

How about creating a new account, letting bitwarden create a password, only for them to send me a clear text copy of that passwod in their confirmation email....

My favorite is when they don't have this check, but silently slice the string to meet the requirement, so that you can't login with the original password the next time.

Don’t worry, pretty soon they will just block password managers from autofilling fields on their login page so that you HAVE to remember your password! Then you’ll be happy it can’t be that long, you can only fit so much on a post-it note on the side of your monitor

/s

EDIT: I think there should be a law against blocking password managers for filling in fields. Any brute force bots are going to submit HTTP requests directly anyway; no one is hitting the DOM to do that

For a system I worked on a few years ago I got the password requirement:

• Only upper case letters A-Z, no letter or symbols.

• Exactly 7 characters.

I was also recommended to make it a single word to make it memorable.

funniest experience that ive had is that i made a psn (playstation network) account with a 64 (iirc, might have been 32, dont remember) character password. That worked making the account on my PC on their website. Never was able to log into that account on my playstation tho and the error message was just some generic error. Support didnt know what was going on and i didnt either until it dawned on me. The password was too long for the console. Changed the whole thing to a shorter one and now it works everywhere. Used to work on their website, not in the app, not on console. Fun.

The password should be hashed anyway, which has a fixed output

i once used 20 for a bank. the website havent told me it was too long just clipped off 2 and accepted the rest. not even the banking support was able to help me. took me a few days to solve this by accident.

Recently had a password that was acceptable for the account creation page on the website but too long for the login screen in the mobile app.

Took me a while to figure out that pasting into that field was just quietly dropping characters.

I don't have it in me

https://neal.fun/password-game/

If I have to create a password Ill need to remember and don't have access to my password manager for whatever reason I have a long phrase that's my go to but I have a system about adding numbers and characters to it based on the context of the log in. Sites with character limits really fuck that up.

There should be a limit to prevent DoS attacks but really it should be like 1M characters or something.

One time I worked a job where you had to make EXACTLY a 12 character password using only ten letters and two numbers.

The password on my PC is something like 30 characters long. Back when win10 was first coming out, they were pushing getting an actual outlook account and tying that to your login. I was hesitant at first, but figured I'd try it out and see how that worked for me.

Turns out outlook accounts (at the time) had something like a 16 character limit on passwords. Bruh.

When I banked with wells fucking fargo they had issues similar to this. I had something like a 16 character password and I once forgot the last character and it accepted it anyway, so there was some kind of character limit that they didn't make obvious.

I also had a time I accidentally had caps lock on, and my password still was accepted. Their passwords were not case sensitive even though their password screen says they were.

Obligatory https://neal.fun/password-game/