Absolutely, you are of course correct. The uppercase letters and digits - together with the special characters like "!._-,...". I kept it to 26 letters to keep

Absolutely, you are of course correct. The uppercase letters and digits - together with the special characters like "!._-,...". I kept it to 26 letters to keep the math simpler (or rather - the numbers smaller, for myself, really). Number of days to brute-force if 10k requests/sec (26 letters still...): 4-length password = 45 seconds 10-length password = 453 years Please give me a heads up if my math is off.