Usually whichever sounds like the answer could be long (in case there’s validation)… Then I generate a 2nd random password for it and store it in my password manager.

Data breach again? Fuck you corporate America.