The worst is when they accept your long password only to truncate it silently so the password doesn't work when you use it to login.
Is this a common problem? Which sites do this?
It's also happened where sites have updated their password policy, e.g. to set an upper length limit after I signed up and now I can't login because it won't let me enter my longer password.
I think they simply truncated the input though, but didn't enforce a maximum length during signup.
But there is a lot of wiggle room between maxlength=8 and allowing people to upload the source code of DOOM as their password.
You store a cryptographic hash of the password, which will always be a fixed length.
This makes the actual password length irrelevant to back end storage.
What you do is use a hashing function[0] in the provided password and you store this result in the database. And these hashes tend to have a fixed size output. So it doesn't matter if your original password had 10 or 200 characters, the resulting hash will have the same size.
[0] - https://www.authgear.com/post/password-hashing-salting