WHY DO WEBSITES STILL RESTRICT PASSWORD LENGTH? (REDDIT THREAD)

Summary from the TLDR Web Dev newsletter

Websites still restrict password length, even when long, complex passwords are more secure. One commenter explains that the limitations aren't related to database size or DDoS prevention, but rather due to the input length limits of password-hashing algorithms like Bcrypt. Others suggest limits are holdovers from older assumptions about password memorability, legacy systems, or a desire to reduce customer service requests related to forgotten passwords.