Why, oh why, are passwords limited to 16 characters? It simply baffles me that modern applications are still being built with these pointless limits. Can you please explain your reasoning to me?
Then I would suggest you to look out to the opposite problem, denial of service via long passwords (assuming that you correctly use a slow key derivation function).
e.g. Django now accept passwords with at most 4096 bytes because attackers used gigantic passwords that took a long time to hash
Who can force break 16 char passwords (especially with non-alphanumeric chars in)?