I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about security.

I understand *most* people will pick short passwords like "password" and "123456" but are there technical reasons to force this? Using an application like 1Password, almost all my passwords are something like `fx9@#^L;UyC4@mE3<P]uzt` or other randomly generated long strings of unlikely to guess things.

 - Are there specific reasons why websites enforce strict bounds on password lengths?