Are penalties applied if you have too many 404 errors on your site?

It depends on why the 404 errors are coming up but in general terms, yes, high numbers of 404 errors can count against the quality metrics of your site and hurt your rankings.

Whenever Google spiders the web, they are following links from external sites to yours, your own internal structure, and your past indexed pages. While 404s themselves are not a negative indicator according to the linked article above, 404s of expected content due to errors in your internal linking or server configuration (i.e., a bad redirect rule) will lower the number of documents you have indexed and that is the "penalty" applied.

There are several things you can do to mitigate the effect of 404 errors:

1. Use a custom 404 error page to suggest alternative navigation. The inbound user or robot should be presented links and a menu to assist them in finding other content on your site. Never leave a default 404 server-generated error page in place
2. If the 404s are caused from external links, use 301 redirects to get the inbounds to the desired location
3. Use an XML sitemap to tell search engines what exists. This helps to drop dead pages out of their indexes

Follow those simple steps and any penalty caused by excessive 404 errors should fall away over time.

Google's John Mueller says:

404 errors on invalid URLs do not harm your site’s indexing or ranking in any way. It doesn’t matter if there are 100 or 10 million, they won’t harm your site’s ranking.

(as long as the 404 isn't coming from pages you want to see ranking)

Some other guidelines:

• You shouldn't link to 404 pages.
• If a repeated 404 error is due to an obvious mistake such as a typo in a URL, you should redirect it to the correct page for better user experience and to get link juice from incoming links.
• You shouldn't include 404 URLs in your XML sitemap.
• You shouldn't try to fix 404 URLs that look like junk. Search engines expect sites to return a 404 status for URLs that shouldn't have content. Google gives you an error report of 404 URLs because it may be useful to you and you may be able to find broken links on your site. Those URLs don't have to be "fixed" for good SEO. Almost no site has a completely clean 404 report.
• If a page has been removed a "410 Gone" error is technically more correct than a "404 Not Found", but a 404 isn't awful.

In Google Webmaster Tools it says 'they generally don't hurt your ranking.'

However, they are bad for user experience and search engines don't buy things.

To quote the Google Intro to SEO .pdf:

Blockquote ...you should base your optimization decisions first and foremost on what's best for the visitors of your site. They're the main consumers of your content and are using search engines to find your work.