Password length restrictions: three bugs for the price of one

Hi Steve, Thank you very much for bringing these issues to our attention.&nbsp; We take account security seriously, and password guidance and restrictions for users is a key component of that.&nbsp; The character length limitations are meant as guidelines, and you are correct in saying that an upper limit is unnecessary; we will work on getting that removed as soon as possible or, more likely, increased to a number just bordering on what would be reasonable to send in an http request. I'll address your points individually: The lower boundary is an absolute minimum, and we will strongly consider increasing that. As mentioned above, there is no need for an arbitrarily low upper limit.&nbsp; I will address your point on password storage; passwords are immediately hashed using bcrypt, and we have and will continue to steadily increase the difficulty of the hash on a regular basis. This is indeed a bug related to a the String sanitization component of software that was upgraded somewhat recently.&nbsp; We will resolve this as well. If you have any more questions, feel free to respond or reach out to <a href="mailto:team@roll20.net" rel="nofollow">team@roll20.net</a> . Thanks again, Jeff