Shouldn't services store a salted hash? Big red flag if they restrict password length at such low numbers