I would like to know why there is a limit for password length. If you really want to avoid people that would try to glitch your website, then make the limit at 100 or 200, but not 20! All passwords are potentially vulnerable to brute force. There is no good reason to limit the password length...