What are you talking about? Taken to its logical conclusion you would have sites support passwords up to a million characters or else it is a sign that they are insecure. Having some limit is perfectly sane.<p>I also find it a bit &quot;armchair quarterbacky&quot; to be calling out PayPal on security practices. They&#x27;ve been around the block a few times, and though I certainly don&#x27;t love them, they aren&#x27;t making rookie mistakes like not-hashing passwords or the like.<p>You are just spreading FUD for no discernable reason. 20 characters while not the epitome of greatness, isn&#x27;t a sign of the end times.