You can DOS a site that doesn&#x27;t have password length enforcement. 20 characters really is too low though, because it rules out a lot of pass phrases. I believe Django allows up to 4mb for the password, which is more than enough for any sane password.