Well OK but not all passwords are hex numbers! Given that testing a few simple classes the length of the shorter one takes about a second or two then that seem

Well OK but not all passwords are hex numbers! Given that testing a few simple classes the length of the shorter one takes about a second or two then that seems worthwhile. It's been a while since I fired up John the Ripper but it has low hanging fruit modes built in. So even if you are using quite long simple alphanum strings of gibberish then seriously consider adding one or more character class into the mix eg capitals and easy to identify special chars like $£% etc. To really go for gold why not mix entire scripts eg the usual en_* alphabet and say Bulgarian Cyrillic. Gasp as your keyboard mapper explodes! Alternatively, look into MFA.