3 ms·

It may not even remotely be the user's fault as well, if generated passwords can have unicode characters.