Also, online logins should lock you out temporarily after a few failed attempts anyway, making brute force a complete non issue.

Also also, if you’re going to try to brute force someones pw, you would just look up the requirements beforehand anyway.