Some websites state specific requirements for a password when you create an account. Some are understandable, but in particular the maximum password length doesn't make sense to me. Some websites restrict the password to no special characters, only numbers and letters, and the password has to be between 8-16 characters.
Doesn't that limit the entropy to a point where a really secure password is not even possible? If the attacker knows the requirements, wouldn't bruteforcing be way to easy if they acquire the database.
Also is there any technical limitation that would explain a maximum password length? I understand that for example bcrypt has a maximum of something like 72 characters, which seems fine to me. But for what reason would someone choose 16 as the maximum?
Does it maybe even indicate that the passwords aren't stored securely and teh password length is restricted so the website can save on database space?