diff --git a/change.go b/change.go
index cab8b9e..36b2b6e 100644
--- a/change.go
+++ b/change.go
@@ -11,6 +11,9 @@ func checkPasswdConstraint(password string) error {
 	if len(password) < 12 {
 		return errors.New("too short, please choose a password at least 12 characters long")
 	}
+	if len(password) > 128 {
+		return errors.New("too long, please choose a password at most 128 characters long")
+	}
 
 	var hasUpper, hasLower, hasDigit bool
 	for _, r := range password {
diff --git a/change_test.go b/change_test.go
new file mode 100644
index 0000000..89dd24f
--- /dev/null
+++ b/change_test.go
@@ -0,0 +1,33 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestCheckPasswdConstraint(t *testing.T) {
+	tests := []struct {
+		name    string
+		pass    string
+		wantErr bool
+	}{
+		{"valid password", "Correct1Horse", false},
+		{"too short", "Short1A", true},
+		{"exactly 12 chars", "Abcdefgh1234", false},
+		{"no uppercase", "correct1horse", true},
+		{"no lowercase", "CORRECT1HORSE", true},
+		{"no digit", "CorrectHorse!", true},
+		{"exactly 128 chars", strings.Repeat("a", 126) + "A1", false},
+		{"129 chars is too long", strings.Repeat("a", 127) + "A1", true},
+		{"very long password", strings.Repeat("Aa1", 100), true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := checkPasswdConstraint(tt.pass)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("checkPasswdConstraint(%q) error = %v, wantErr %v", tt.pass, err, tt.wantErr)
+			}
+		})
+	}
+}