NO reason. After all the only thing going into the database ought to be base64 encoded hash. So why not allow anything? No need for a max length, by the same token.