Disallowed characters like that give the impression that plaintext passwords are being stored.