So in a sense all hashed passwords have the same length in a database. But as Paul said a password function is the best way to go. You can also set a password expiration of 3 months, which will make people change their passwords, but not necessarily the next time they log in. You should include password complexity as well and password reuse restrictions.