Recently, someone asked what the maximum length of a password is.
I would have expected this to be documented in FAQ #148 along with the other limitations on data, but it isn't.
From looking at the source of changepassword.bml, it appears that this limit is 30 characters. (The form lets you submit 31 so it can tell the difference between "30 characters entered, 30 intended" and "30 characters entered, more intended but the form cut you off" - if you submit 31, you get an error message.)