Yet with just [A-Za-z] and 10 random chars you're at 52^10 ~ 1E17 while your wider choice set gives 92^8 ~ 1E15, so ten random alpha chars is really better than

Yet with just [A-Za-z] and 10 random chars you're at 52^10 ~ 1E17 while your wider choice set gives 92^8 ~ 1E15, so ten random alpha chars is really better than ten alpha+number+punctuation. Suddenly it takes a paltry 229 thousand centuries (or 22 million years) with bcrypt at 0.3s. Using punctuation does not make a password "more random", it only makes the random choice set slightly larger. Bumping the length is much more significant than bumping the set as it's exponential. The debate is whether it's easier for a user to both pick and remember a "random-enough" - i.e not easily bruteforce-able, regardless of hashing technology - [A-Za-z]{10} password or a [A-Za-z0-9!@#$%^&()_-+=;':",.<>/?\|[\]{}]{8} password. For the record, Google's 2-factor auth generated app-specific passwords are [a-z]{16}, which gives 1E22, or 230 billion years with bcrypt at 0.3s.