As the title states, the registry has a maximum password length of 128 characters(tested with just alphanumeric characters). This should either be stated as such, or the limit should be removed.
If non alphanumeric characters are used, that limit might be lowered, if it isn't a character but a byte limit.
Create an account or change the password of an existing account, and set the password to some password that is 129 characters long or longer.
I am not sure if there is some type of spam-protection to fight brute force attacks.
But a length 128 mix of upper and lowercase chars + numbers should already deliver a quite high entropy.
However, sure, if special characters could be made possible, that may help with security.
While I haven't tested unicode characters, it's very highly unlikely that it's a byte limit.
The password update page now states the valid password length range, and displays an error notification for invalid lengths.