system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5: Why do most websites have character limits for passwords while at the same time they force you to have an upper/lowercase letter, and a number to make your password more secure. Wouldn't removing the character limit and allowing much longer passwords make them more secure than 16 characters?
gpt
Convention.


There is no technical strength to doing so. Users who will use insecure passwords without the restrictions will use insecure passwords with the restrictions, and cracking these cases isn't all that much more demanding. Meanwhile, increasing password length does substantially increase security. It would be far better practice to have, say, 10 characters minimum and no maximum than is currently common.