Q:

Does a maximum length of password mean non-hashed storage?

When a system requires a password between say 6 and 20 characters in length, does it mean the password is stored without using a hashing function, and that the mysql-field (or similar) is 20 characters in length?
Is there any reason to have a maximum length if a hashing function is used?
I'm thinking maybe a DOS-vulnerability when hashing huge passwords. A ~100 character limit should be enough to stop this, without disturbing users. Maybe even cut the password at a specific length before hasing it?

A:

There are a few reasons that limits might have been imposed:

Some developers feel that reasonable limits (e.g. 120 chars) help reduce server load for hashing ludicrously sized passwords. In reality, the transfer overheads are probably more intensive, as the data is reduced down to a fixed length state in the first round of most hashes, so it's a rather moot point.
Legacy advice. Really old systems used to have technical limits that required passwords to be short (e.g. 14 chars or less) and this has permeated into advice given to new developers. It's irritating and backwards, but it happens. It also ties into the "we've always done it that way" attitude that a lot of places have.
Reducing tech support calls and reset volume. This is by far the most legitimate reason, but it also comes with some caveats that make it largely a bad idea. Users are expected to forget their passwords every so often, and complex / long passwords are seen to increase this rate. However, if you happen to have a "structure" to your password, which involves a fixed length that is too large for this particular service, then it leads to a higher likelihood of resets.

All in all, it doesn't mean that hashing isn't being done. It just means that they're following bad advice and continuing a status quo of poor practices.
Some related questions:

What technical reasons are there to have low maximum password lengths?
Should I have a maximum password length?
Does bcrypt have a maximum password length?

