Comment by dredmorbius

Or an arbitrary number of characters. If you know the additional six alphanumeric characters added, that's another 14 million combinations to test.

Or 2FA, or ....