I couldn ' t resist . <| sep |> Additionally , depending on how securely your password is stored , it might be possible to access its length I think ? , in which case for any given word replaced in the password , you have words of only a particular length to guess since the hacker would know the total length . In theory a flawed protection scheme like this could exist , but any cryptographic hash , which are industry standard for storing passwords , produces a fixedlength string or rather a random number from a certain range encoded as a fixedlength string , which will hide any information about password length if the database were to be leaked . It would take an extremely incompetent or actively malicious developer to fuck that up . And if it ' s stored in plaintext then there ' s no cracking required when the db leaks .