Even if the password box accepts the full string, some sites truncate it in the backend. A good test for this is to try logging in with your full password except for the last character. If that works, keep deleting characters until you can't log in anymore, and then you'll know how many characters it really supports.

Hopefully nobody still does this, though with the rise of vibecoding, who knows…