As far as I know, when passwords from a website leak, they leak in an encrypted form.
First of all, in general, passwords are not encrypted, they are hashed with good password hashing algorithms (like PBKDF2, SCrypt, Argon2) using a random salt per password. The password hashing algorithms are candidates for one-way functions, so there are no inverses of them as the encryption algorithms in which the decryption is the inverse of the encryption with the help of the key. The usual attack on those password hashing algorithms is searching for some space and testing for a known password set; John the Ripper and Hashcat are some of the tools that one can use.
Some sites like Facebook stored the password in a clean format. When hacked, the hackers get all easily. If the passwords are well protected then the attacker needs to apply the search.
Are all those passwords the same easy to decrypt? My hunch is that a 10-characters-long password maybe gets decrypted in a few minutes, but if a password is 100-characters-long, it takes days or years to decrypt. Does it make sense?
Here, assuming that we are brute-forcing the hash of the password, in that case, the 10 characters ( including the case sensitive and alphanumeric ) have 5.954 entropy per character. This makes 59.54 entropy and this can be achievable with supercomputers or with the collective power of bitcoin miners. Approximately, they can reach
267.9 in a second, 284 in a hour, 284.3, in a day, and 292.8 in a year. This can give us some insight into possible agencies that may have the same or more power.
One must keep in mind that, running SHA256d as the miners do is not the same as running for PBKDF2, SCrypt, and Argon2 those are memory-hard password hashing algorithms. The memory-hardness prevents massive parallelization on GPU, ASIC, and FPGAs. Since the nodes of mining are not exact, estimation is not easy, however, if we look at Summit's Titan SUper computer that uses Tesla V100 27,648, and Titan can calculate around 247 PBKDF2-HMAC-SHA256 hashes per year. That is a drop from 274, according to hashcat results.
100 characters make sense and not. Setting it to 100 makes 594.4 entropy that is far from the need. Less than 256 should be enough for all. The problem, however, humans cannot memorize that kind of stuff so researchers developed dicewire and Bip39 kind of password systems so that they can have good entropy and easy to memorize. A must-see is XKCD/936.
Is setting a very long or difficult password real protection from leaks? I'm asking even about passwords like passpasspasspass11111passpasspasspasspass with comparison to pass11111.
Once you have a password that has good entropy and has different for each site/application then you should be safe. The usual way is using a password manager to manage all passwords like the key-pass and use a password with a good entropy to keep the passwords safe.
There is competition on password set that actually search that kind of pattern, too. Forget about them and use dicewire kind of passwords that you can measure the strength of your passwords very easily.