The difference is that people (and software that people write) often treat URLs differently than a password field. 12 characters might take X amount of time to

The difference is that people (and software that people write) often treat URLs differently than a password field. 12 characters might take X amount of time to brute force, but if you already have the 12 characters, that time drops to zero.