[chrj]

From the patch, it doesn't look like it's bytes, but characters.

[Perseids]

Where do you see this? In https://github.com/django/django/commit/aae5a96d5754ad34e48b... they specifically mention bytes.

[masklinn]

MAXIMUM_PASSWORD_LENGTH is used as the max_length of CharField. CharField are unicode, and thus if one reads no further than django/contrib/auth/forms.py and doesn't see MAXIMUM_PASSWORD_LENGTH is also used on KDFs input (which work on bytes) one may get the impression that it's a limit on code units.