Maximum length tops my list of favorite restriction, because it strongly suggests that they&#x27;re keeping my password in the clear somewhere - or they used to, and just never got around to changing it.<p>The concept of illegal characters is tied for second.  If you&#x27;re handling it right, there should be no such thing - yet so many sites continue to set arbitrary limitations for reasons that aren&#x27;t clear even to them.<p>Kind of wish I could just generate private keys for each site and not think about it anymore. (Yes, I know there are some convoluted ways to do this, but they&#x27;re not particularly usable.)<p>THe best part is that even so many new and&#x2F;or modern  sites enforce the same arbitrary requirements.