It's significantly more difficult to reuse the base and figure out the additional characters than it is to get access to the user whose password is 'password'

It's significantly more difficult to reuse the base and figure out the additional characters than it is to get access to the user whose password is 'password' For insecure services that I use on mobile, public, etc computers, I do this.