Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've noticed some websites, generally financial institutions, limit password length to a relatively small number. For example, mint.com limits is passwords to 16 characters (at least on the sign up page.) Why would they do that? I've read that sometimes websites will do that to limit the time password hashing algorithms run.

share|improve this question

closed as off topic by random Oct 8 '11 at 18:38

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Password hashing algorithms are fast enough that a few extra bytes don't matter; even megabytes can be hashed in milliseconds. Often the passwords aren't hashed at all, though, and stored in fixed-length fields... try security.stackexchange.com –  grawity Oct 8 '11 at 19:44
It means they are idiots when it comes to allowing secure passwords. –  Moab Oct 8 '11 at 20:13

Browse other questions tagged or ask your own question.