How much would unknown password length protect against bruteforcing a 1 character password?