Depends, nowdays most sites accept big passwords, not that long ago sites would silently truncate long passwords or not accept them. Anywhere between 20-64 depending on the site. Really I just try to be good about rotating ones that matter. There is so much to explain that I'm not gonna.
I'm of the opinion you're less likely to get pwned because you used a weak entropy in your random password, than the strength of platform that's accepting the password is against brute force attacks.
Common vectors
- brute force against platform with unknown hash (depends heavily on platform's brute force protections)
- lookup table against platform - serves to reduce the set of brute force (again depends on platform)
- brute force against leaked hash - hope that the hash algorithm used by the platform is strong against brute force, matters more than password entropy
- lookup table against leaked hash - dependent mostly on password entropy, generally any randomness breaks this
So long as a sturdy hash algo is used by the platform, leaked hashes, id argue are basically time invariant to a difference of a few characters. Password rotation helps reduce the window for brute force.
Most important prevention is that your passwords are 100% unique to you. Such that if the hash leaked, or the platform was weak, you're comprimise won't spread to other things you need.
ChipTuner
npub1qd…3fqm7
2026-10-21 22:17:28 UTC
in reply to nevent1q…7ftm
Author Public Key
npub1qdjn8j4gwgmkj3k5un775nq6q3q7mguv5tvajstmkdsqdja2havq03fqm7Seen on
wss://nostr21.comPublished at
2026-10-21 22:17:28 UTCEvent JSON
{
"id": "f83f9868ec6f16bedae6bafe3ca80e9814df27c84ccfe1fc1f8a42bdcb5ea38a",
"pubkey": "036533caa872376946d4e4fdea4c1a0441eda38ca2d9d9417bb36006cbaabf58",
"created_at": 1792621048,
"kind": 1,
"tags": [
[
"e",
"bdd6c1d7aa9833d5420226e907cbab0e7e9727584c15e7602f6db05dd3443129",
"wss://theforest.nostr1.com/",
"root",
"9ca0bd7450742d6a20319c0e3d4c679c9e046a9dc70e8ef55c2905e24052340b"
],
[
"e",
"bdd6c1d7aa9833d5420226e907cbab0e7e9727584c15e7602f6db05dd3443129",
"wss://theforest.nostr1.com/",
"reply",
"9ca0bd7450742d6a20319c0e3d4c679c9e046a9dc70e8ef55c2905e24052340b"
],
[
"p",
"9ca0bd7450742d6a20319c0e3d4c679c9e046a9dc70e8ef55c2905e24052340b"
]
],
"content": "Depends, nowdays most sites accept big passwords, not that long ago sites would silently truncate long passwords or not accept them. Anywhere between 20-64 depending on the site. Really I just try to be good about rotating ones that matter. There is so much to explain that I'm not gonna. \n\nI'm of the opinion you're less likely to get pwned because you used a weak entropy in your random password, than the strength of platform that's accepting the password is against brute force attacks. \n\nCommon vectors \n- brute force against platform with unknown hash (depends heavily on platform's brute force protections)\n- lookup table against platform - serves to reduce the set of brute force (again depends on platform)\n- brute force against leaked hash - hope that the hash algorithm used by the platform is strong against brute force, matters more than password entropy\n- lookup table against leaked hash - dependent mostly on password entropy, generally any randomness breaks this\n\nSo long as a sturdy hash algo is used by the platform, leaked hashes, id argue are basically time invariant to a difference of a few characters. Password rotation helps reduce the window for brute force. \n\nMost important prevention is that your passwords are 100% unique to you. Such that if the hash leaked, or the platform was weak, you're comprimise won't spread to other things you need. ",
"sig": "a87548e4827aad1c8cec74c738cc472c968d9043360c4e29a8c683c38936f0ba3b89a4f5973c06355de05a4e24ac56adffba7ab9a985284481f20eab437e590a"
}