Safe for what and against whom? If an attacker can make unlimited login requests to a service, then longer passwords are always safer than shorter but more com

Safe for what and against whom? If an attacker can make unlimited login requests to a service, then longer passwords are always safer than shorter but more complex passwords. If an attacker has a copy of a service's hashed passwords, the same is also true. If an attacker is physically looking over your shoulder, a passphrase may be easier to remember than random letters, digits, and symbols. If an attacker is a nation-state with a quantum computer and an unlimited budget - they'll probably find a different route into your account. I would say that passwords are rarely "cracked". People tend to either use one of the top 10,000 common passwords, or reuse the same "secure" password on multiple sites. If you are outside of that low-hanging-fruit, why would someone expend resources on you?