This question already has an answer here:

I just made a new account with some eGov service (Belgian government). I use LastPass (which generates long, random strings for each site),

But the system told me that the maximum allowed length was 16 ASCII symbols. Why do people do this? If they hash it, then the length should not matter, right?

Is there a reason for this? I cannot see a any good explanation for this. What am I missing something here?

marked as duplicate by Adi, TildalWave, Ayrx, Jeff Ferland Jun 13 '13 at 16:04

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Some hash functions are based on block ciphers like DES. The maximum (effective) input size of these algorithms are limited by the block-size of the internal cipher. See for example:



There is of course a non-negligible possibility (we are talking about eGov) that the password storage of your particular service is fundamentally flawed.

  • 3
    LM-hash&co are totally broken – CodesInChaos Jun 13 '13 at 14:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.