> if you have safeguards in place such that 16 character passwords can't be bruteforced than you don't gain much by going to 256 Yes, right until the day your

> if you have safeguards in place such that 16 character passwords can't be bruteforced than you don't gain much by going to 256 Yes, right until the day your database gets accessed by intruders and they steal all your hashes for fast offline cracking. Which just happened.