@jcoglan yes. One brute-forced an account on my server a couple of days ago. But your passwords are doubtless more secure than my users'