It would also let hackers know what combinations not to try.

I have a better proposal: If your login page has any restriction on passwords (other than being part of Unicode and a max length of 128 characters) then your site should be shut down.