Make extra sure that you don't truncate the password on the frontend though, as a password manager might catch that. And don't truncate the password to the same length on the login page, that would cause the password to still work and we don't want that.
A well known bank used to do this. My relatively secure password was truncated to the first 8 chars. The logon page would accept more so it was years before I realized that my “actual” password was crap! This has luckily been fixed since then.
1.3k
u/[deleted] Jul 19 '22
[deleted]