And if a site does have such restrictions, it could be an indication that they store passwords in plaintext, rather than hashed