A website that uses passwords should do nothing to a supplied password other than hash it, unaltered. What you're given is what you're given and no characters should be forbidden. If someone wants to include a space, a left-brace, an acute-a, a copyright symbol and the Chinese character for water, it should work.

Obviously you should have strength checks to help stop users being idiots, but even a length check should be very very generous. 256 characters is a hideously long password, but not so long as to be problematic to hash.

Wade.