Taking the string " 
" as an example, javascript says
"😀".length = 2
and Ruby says
"😀".length = 1
Which is the correct implementation here? @codinghorror's blog post says:
because it’s nice and simple for users. So is one character. That sounds reasonable to me.
However… the blog also says
This is indeed true of the Discourse password fields - one emoji = 2 characters. So if it’s showing as 2 characters in the password field, surely that should count as 2 characters in a password 
On a related note, it is currently very difficult to type emojis directly into html password inputs - you can only copy/paste them in. This is the case on Chrome on mac (using system emoji window), and also Safari on iOS (the emoji button doesn’t even show up with the password field focused). So, as much as I try, I can’t use 
as my password on Discourse (without cheating with copy/paste).