It seems that any character is allowed? Or are there any characters that are NOT allowed when storing/updating passwords?
Any character is allowed. MongoDB however uses BSON which takes utf-8 character set though that’s probably not worth worrying about unless specifically accepting other character sets