Hacker News Reader

Paypal did this with 20 characters. I can't even remember how I figured it out so I could login.

I don't know if it truncated it automatically or it just stopped accepting input after 20 characters and I of course did not notice since the password entry fields were masked.

Their password reset form didn’t have the restriction, so you could reset your password to 21 chars, and then never log in again

HSBC had this problem. Not sure if it still does, but it's a big enough institution that I feel it deserves being called out.

Permanent TSB in Ireland did the same until like 2020.

I had this problem with Transunion (a credit reporting agency in the US). They shortened my password to 15 characters, didn't tell me or anything, I had to figure it out myself when trying to login.

Same, on multiple sites. It is obnoxious as heck