diff --git a/lang/en/message.php b/lang/en/message.php
index 2691e989842..3d7f5a8a33d 100644
--- a/lang/en/message.php
+++ b/lang/en/message.php
@@ -44,6 +44,7 @@ $string['editmessages'] = 'Edit messages';
 $string['emailtagline'] = 'This is a copy of a message sent to you at "{$a->sitename}". Go to {$a->url} to reply.';
 $string['enabled'] = 'Enabled';
 $string['errorcallingprocessor'] = 'Error calling defined output';
+$string['errormessagetoolong'] = 'The message is longer than the maximum allowed.';
 $string['errortranslatingdefault'] = 'Error translating default setting provided by plugin, using system defaults instead.';
 $string['eventnotificationviewed'] = 'Notification viewed';
 $string['eventnotificationsent'] = 'Notification sent';
diff --git a/message/classes/api.php b/message/classes/api.php
index 25246a0c7c0..bad2477c79f 100644
--- a/message/classes/api.php
+++ b/message/classes/api.php
@@ -46,6 +46,11 @@ class api {
      */
     const MESSAGE_ACTION_DELETED = 2;
 
+    /**
+     * The max message length.
+     */
+    const MESSAGE_MAX_LENGTH = 4096;
+
     /**
      * Handles searching for messages in the message area.
      *
diff --git a/message/externallib.php b/message/externallib.php
index eed848ddd14..e5cd57365ed 100644
--- a/message/externallib.php
+++ b/message/externallib.php
@@ -126,6 +126,12 @@ class core_message_external extends external_api {
                 $errormessage = get_string('touserdoesntexist', 'message', $message['touserid']);
             }
 
+            // Check message length.
+            if ($success && strlen($message['text']) > \core_message\api::MESSAGE_MAX_LENGTH) {
+                $success = false;
+                $errormessage = get_string('errormessagetoolong', 'message');
+            }
+
             //check that the touser is not blocking the current user
             if ($success and !empty($blocklist[$message['touserid']]) and !$canreadallmessages) {
                 $success = false;
diff --git a/message/templates/message_area_response.mustache b/message/templates/message_area_response.mustache
index de3cfb6b914..5bcbd7369c4 100644
--- a/message/templates/message_area_response.mustache
+++ b/message/templates/message_area_response.mustache
@@ -22,7 +22,8 @@
         data-max-rows="5"
         role="textbox"
         aria-label="{{#str}} writeamessage, message {{/str}}"
-        placeholder="{{#str}} writeamessage, message {{/str}}"></textarea>
+        placeholder="{{#str}} writeamessage, message {{/str}}"
+        maxlength="4096"></textarea>
 </div>
 <div class="send-button-container">
     <button class="btn btn-link" data-action="send-message">{{#str}}send, message{{/str}}</button>
diff --git a/message/tests/externallib_test.php b/message/tests/externallib_test.php
index 9ae8b7ed814..4ebcb798b49 100644
--- a/message/tests/externallib_test.php
+++ b/message/tests/externallib_test.php
@@ -144,6 +144,48 @@ class core_message_externallib_testcase extends externallib_advanced_testcase {
         $this->assertEquals($sentmessages[0]['clientmsgid'], $message1['clientmsgid']);
     }
 
+    /**
+     * Test send_instant_messages with a message text longer than permitted.
+     */
+    public function test_send_instant_messages_long_text() {
+
+        global $DB, $USER, $CFG;
+
+        $this->resetAfterTest(true);
+        // Transactions used in tests, tell phpunit use alternative reset method.
+        $this->preventResetByRollback();
+
+        // Turn off all message processors (so nothing is really sent)
+        require_once($CFG->dirroot . '/message/lib.php');
+        $messageprocessors = get_message_processors();
+        foreach($messageprocessors as $messageprocessor) {
+            $messageprocessor->enabled = 0;
+            $DB->update_record('message_processors', $messageprocessor);
+        }
+
+        // Set the required capabilities by the external function
+        $contextid = context_system::instance()->id;
+        $roleid = $this->assignUserCapability('moodle/site:sendmessage', $contextid);
+
+        $user1 = self::getDataGenerator()->create_user();
+
+        // Create test message data.
+        $message1 = array(
+            'touserid' => $user1->id,
+            'text' => str_repeat("M", \core_message\api::MESSAGE_MAX_LENGTH + 100),
+            'clientmsgid' => 4,
+        );
+        $messages = array($message1);
+
+        $sentmessages = core_message_external::send_instant_messages($messages);
+        $sentmessages = external_api::clean_returnvalue(core_message_external::send_instant_messages_returns(), $sentmessages);
+
+        $this->assertEquals(
+            get_string('errormessagetoolong', 'message'),
+            array_pop($sentmessages)['errormessage']
+        );
+    }
+
     /**
      * Test create_contacts.
      */