Given today's cloud hardware availability the leaking of the hash of an 8 character password is only good for a few days. The current reasonable minimum is 12 characters.
Far too many sites out there reject longer passwords, or have a strange dislike of a single special character (which of course differs between sites)
Let me use 64 character passwords, dammit!
You'd think this is truly the one thing the industry could agree on, but instead you have sites that restrict you to 12 characters, alphanumeric only.