not a password rule but: i use a password length of > 40 characters because why not? signing up for paypal worked with that no problemo until i had to sign in again and the login input ignored everything north of 20 characters or so. It worked after removing the maxlength attribute :(