The backend doesn't really impose a maximum length on passwords. But a 1000 characters seems more than enough right now.