Many sites have had unreasonable max length limits on passwords, such as 4, 6, 8, or 12 characters. These unreasonably short limits are bad. However, some seem to take this logic to an extreme, suggesting that even much larger limits are detrimental. Once you get up to say 14-16 random characters or 4-5 random words, with proper hashing, there's just no realistic risk of your password being brute forced. Beyond that you're just wasting effort. And someday it's conceivable you'll need to type that password in on a device where you can't install your password manager; what then? So, giving it plenty of margin; say someone wants to type in 10 10-character words, and round up to 127, or even 255 if you like. I'm going to go on record saying there's no reasonable reason to allow password inputs longer than that in 2020. (And there's no real reason to make passwords nearly that long, but also not much gained by restricting them further.)
I welcome responses explaining why passwords of hundreds of characters would ever be necessary or useful.
Most password managers don't even let you generate passwords longer than 50-100 characters anyway.
So long as you're using a password manager that generates unique passwords for every site you visit, there's no real reason to have those generated passwords be particularly long. Ten random characters (with enforced complexity rules) is more than ample for any normal, plausible scenario. If you're a high value individual, you might want to eliminate any doubt and use 12–15 characters. Exceeding that is security masturbation—but also lacks any downside so long as you never have to transcribe it.
Or if you fear worldwide retribution, 20 characters is enough to withstand all compute power on earth suddenly dedicated to the task of cracking your Spotify password.
The only scenario I can imagine where the length of random+unique passwords matters AT ALL is if (1) the website uses a very weak/naive password hash implementation (2) a hacker manages to acquire a copy of your hashed password and (3) the account is of sufficiently high value to justify a large investment in computing resources to brute force the hash. Hitting that trifecta is very unlikely indeed.
I welcome responses explaining why passwords of hundreds of characters would ever be necessary or useful.