While on the topic of password best practices, are there any characters which should not be allowed in passwords?

I've always assumed anything is safe since it's getting hashed anyway before hitting the db, but this got me wondering.