1. If they store it in plaintext or encrypted plaintext, then that's probably the maximum value that can be stored in the DB. On the other hand one should get as far as possible from these sites
2. To avoid DOS attacks. This is usually if they have a very high limit, like 512 or 1024 bytes
3. To comply with regulations that are actually made by people not knowing anything about IT security
4. For legacy reasons, as Tom Leek has pointed out

Btw. here is a list of high ranking sites having maximum password lengths:

https://defuse.ca/password-policy-hall-of-shame.htm

1. If they store it in plaintext or encrypted plaintext, then that's probably the maximum value that can be stored in the DB. On the other hand one should get as far as possible from these sites
2. To avoid DOS attacks. This is usually if they have a very high limit, like 512 or 1024 bytes
3. To comply with regulations that are actually made by people not knowing anything about IT security
4. For legacy reasons, as Tom Leek has pointed out

Btw. here is a (historical) list of high ranking sites having maximum password lengths:

http://web.archive.org/web/20130907182806/https://defuse.ca/password-policy-hall-of-shame.htm