Just another in a long list of decisions Django made that makes me dislike it.

Let the client hash the password to reduce it. then enforce the hash length as the password length. It’s transparent to the user and doesn’t look like a pile of bad ideas.