Passwords containing # are cutoff because the password is not encoded before sending and the hash is a valid url tag.

A password of 123#456 would only send 123.