Shared secrets longer than 32 characters will be silently truncated to 32 characters.
Since only the password is encrypted in the Access-Request packet, this can appear in debugging logs (radiusd -xxx or -xxxx) as strange passwords.
Using a mostly-default configuration (enabling the rest module, with method = post and body = json),
these can appear in the request body as a User-Password of some 16-character/27-byte unicode string.