My point is that that is not the worst case. Example of a worse case: the attacker knows that + the first 2 characters of your password (real-life example). Th

My point is that that is not the worst case. Example of a worse case: the attacker knows that + the first 2 characters of your password (real-life example). The worst case would probably be something like "attacker knows hash, passwd algorithm, full state of machine at passwd generation time incl. random seed and all characters of the password but one". It is clearly far worse than your case, though I find your case more relevant than this one.