system
Given the following post, respond as if you're commenting on Reddit:
human
Is there any legitimate reason to have an upper limit on password length?
gpt
If your protocol involves submitting the password to a server instead of locally computing a response to a challenge, you probably want a limit to prevent against unbounded allocation/computation on the server side; otherwise an attacker could send a two-terabyte password and watch your server swap itself to death. But that limit can be pretty generous; a limit in the thousands of bytes won't affect anyone reasonable and won't affect most unreasonable people, either.

If the literal text of the password is synchronized to legacy systems (instead of being immediately hashed and then forgotten), and one of those systems puts a limit on effective password length, it's better to limit the password length up front instead of silently making some characters irrelevant. For instance, old-style UNIX crypt passwords only use the first eight bytes of a password, so if you have the misfortune of setting up a system that pushes passwords to those systems, you should probably not let people think that a longer-than-eight-character password will be useful.