Amen, with a special F.U. to the sites that disallow special characters. What is the reason for that? (OK I might understand disallowing some uncommon chars but $%(^ etc shouldn't be disallowed)
I assume they're hashing all the passwords anyway.
Bad assumption. And many that do hash are using MD5 and don't bother salting.
This is often an external code smell of not hashing the passwords but instead storing them as plaintext in a CHAR(8) field in a SQL database somewhere.