&gt; <i>I can&#x27;t see any reason for this other than that they&#x27;re storing them either encrypted or in cleartext.</i><p>One of the (bad) reasons companies impose password length limits is that the user is less likely to forger a shorter password, and therefore it saves money on inevitable support calls.<p>Granted, a 20-character limit is probably too high for this justification to be valid.