Maybe I'm fuckin' dense (entirely possible) but why on earth would you limit the length of a password? The HSE medical card website does not allow for passwords longer than 20 characters, and no MFA either to top it off Like...c'mon... The same HSE that suffered a complete system-wide shutdown, data breach and ransomware attack only 5 years ago??