Ultimately we don't know the implementation. I've seen some bad sites like stealth truncating on the registration form but leaving the login form unbounded so the password you pasted in both times doesn't work.

Separate issue from truncating, I get suspicious when I see passwords capped to 16-20 chars for the reason you gave that they should be stored as fixed length hashes.

[–] kautau 1 points 1 week ago

That’s true, there’s no way to know what sort of back asswards string modifications are happening to the password before it makes it to a hashing function, if it ever does. But the OP did say they told him his previous password was too long, and he was required to change it, so they were either storing it in plaintext, or storing the length of it somewhere. One is really really bad, one is weird, but also bad