I got a login on an IBM system. I logged in and moved to the change password mask. Changed my password to something filling out the 12 character new password field. Logged out, and got the login mask again. With an eight character password field.

24 is fine, not as bad as 12 and no special character. That's honestly the worst one i've encounter.

my bank app doesn't allow copy paste so i can't have anything that long and hard to type, and they tend to request password login when transferring money.

In password security, the longer the better.

This is only true up to a certain point

In my opinion, an acceptable password length should be L in ln(alphabetSize^L)/ln(2) = (B bits of entropy). For a Bech32 character set (since it excludes ambiguous characters), alphabetSize = 32. A good password should have been 96 and 256 bits of entropy, with 128 bits being my personal preference. This means L = (B)*ln(2)/ln(alphabetSize) = 128*ln(2)/ln(32) = 25.6 = 26 characters.

That's… pretty close to what OP said they were restricted to, so maybe the person who set the 24 character restriction used a similar methodology.

I had this problem with a fucking bank once. Even better are the sites that silently chop off characters after the internal limit, on the backend, but don't tell you or limit the characters on the frontend. I had a really fun time with that last scenario once, resetting my password over and over and having it never work until I decided to just try a shorter password.

There is little point of having a long password. Online accounts don't have the same issues as encryption

Edit: for those curious, here is my source https://cybersecuritynews.com/nist-rules-password-security/

My rationale is that online accounts typically don't get brute forced due to rate limiting and not protection. The NIST guidelines don't specify requirements for online accounts specifically but it does recommend a password of 16 characters in general. I don't really see any need to go above that as you are just making it harder on yourself.

What's the point? no one is brute forcing a 12-15 password if the login system has ANY login attempt protection anyway.

This seems like one of the extreme overkill things...

a game i played doesnt allow special characthers or its too long.

At one point years ago my work finally caught up with the 21st century and allowed creation of passwords longer than the fixed 8 characters it had always been. So I said great, made up something that was around 12 or so that I could remember. Until I logged into some terminal legacy programs we were still using and wouldn't take that length. So yeah, I went back to 8 characters that wouldn't break things. They eventually migrated away from such old programs and longer passwords became mandatory since they'd work everywhere, but I thought it was funny that briefly I tried to do the right thing but IT hadn't thought out the whole picture yet.

You think that's infuriating? Imagine having an ISP that wants you to pick a password of max 8 characters.