[rockland]

Absolutely, you are of course correct. The uppercase letters and digits - together with the special characters like "!._-,...".

I kept it to 26 letters to keep the math simpler (or rather - the numbers smaller, for myself, really).

Number of days to brute-force if 10k requests/sec (26 letters still...):

4-length password = 45 seconds

10-length password = 453 years

Please give me a heads up if my math is off.