It’s even worse when they have a limit and don’t enforce it consistently. I had to submit a big report to my bank because I made a 24 character password at account creation but the login page only allowed 16 characters.