I saw something similar when I used a German government agency&#x27;s website last week to fill out some forms. Their password policy was:<p><pre><code>  - minimum 8 chars
  - contains at least 3 of 4 of the following types of chars:
    - small letters
    - capital letters
    - numbers
    - symbols
</code></pre>
I usually use random-generated passwords that are dumped as hex, i.e. [0-9a-f]{64}, so I just added &quot;A+&quot; at the end. Turns out that didn&#x27;t work.<p>What did work was to <i>prepend</i> &quot;A+&quot; instead of appending it. So apparently they silently truncate long passwords somewhere before the 64th character.