I use a password manager and use passwords of length 22 ([why 22?][1]) or however long they'll let me. (My bank only allows up to 15, sekeritah yay)

Do I worry when I hear that a site that I use had a data center breach? No, I don't worry. That is a comfort of having a really strong password. Some hacker got their hands on my hash? Yeah sure, whatever, have fun kid.

I still get around to changing my passwords when I can remember to. If ultimately the underlying question is: "Should a random 15 character password provide me with comfort even if my hash is stolen?"

Then my answer is yes.


  [1]: https://security.stackexchange.com/questions/46666/at-what-length-does-a-password-stop-making-sense