For details, see the 3a) Authentication & Firewalls section on the main security that your form will give a validation error if anyone tries a super-long password..