&gt; one person could brute force that, in the privacy of their own home, in a trivial amount of time.<p>Yes. And that&#x27;s assuming your pattern (26+26+10)^8 ~ 2e14, but the basic character pattern here is 26 * 26^5 * 10^2 ~ 3e10, almost 10000 times weaker. This is an extremely common pattern, most passwords don&#x27;t follow a uniform distribution of those &quot;numeric, uppercase and lowercase&quot; characters.