How secure your password is depends on how much entropy it has. If you have a 30-character password consisting entirely of English words, that has substantially less entropy than a password of 30 characters selected using a CSPRNG from all 95 printable ASCII characters. Also, if the RNG you used was seeded with (for example) just a 32-bit number instead of a properly seeded CSPRNG, then of course the entropy would be reduced (32 bits).
However, assuming that your password is picked out of a large set with a CSPRNG, then a 30-character password should be impervious to guessing. If you picked such a password out of the Base64 character set, it would have 180 bits of entropy, and if it used all 94 non-space printable ASCII characters, it would have 196 bits of entropy. 128 bits of entropy is considered sufficient for security these days, so those would well exceed that threshold.
Using a strong, unique password is a best practice, so in the event of a breach, it's likely that your account won't have been compromised if you've done so. This is the same reason that many sites which issue things like API tokens issue them with at least 128 bits of entropy: because they're effectively unguessable.
However, we recommend changing passwords anyway in a breach for many reasons:
- Sometimes the attacker may have gotten access to the live system, and then they could just have sniffed the passwords out of memory.
- Sometimes passwords accidentally get logged or stored in plaintext, and that may have happened with your password. If so, it may have been exposed.
- Sometimes the attacker may have tried to change a password with their inappropriate access, and that may have resulted in unexpected credentials.
- On some sites, external tokens and permissions can be expired by a password rotation, so by changing your password, you can make sure that any credentials the attacker may have issued against your account are invalidated.
- Unfortunately, many sites store passwords in a negligent way, such as by storing plaintext in the database. In fact, if the site has restrictions on the allowed password characters or a length maximum shorter than 72 characters (which is the limit for some bcrypt implementations), then it's probably doing this. If so, then your password probably was exposed.
Most folks in the security field recommend using a password manager (e.g., 1Password), and most secure password managers offer a suitable password generation function, so normally in case of a breach, you can just generate a new secure password, change it, and not have to worry any more.