I'm going to recommend that our users start using a password manager and start creating strong random passwords.
Though I don't know what size of a password to recommend. Is it possible for a password to be so strong that it stops making sense?
I want them to have passwords that are strong, random, and long enough so that even if the hashed password table were stolen, that no brute-force or rainbow attack will ever* be able to guess it.
Where ever* is something reasonable. Of course with sufficient time and resources any password can be brute-forced. But at some point in password strength, I think it must stop making sense. I don't want to sound like I'm going overkill and protect their password from a 4th dimensional being or something.
Oh and a 64 character websafe alphabet is what I'm thinking about recommending.