Not only does the credit bureau max out their password length, you have a small list of available non-alphanumeric characters you can use, and no spaces. Also you cannot used a plused email address, and it had an issue with my self hosted email alias, forcing me to use my gmail address.
Both Experian and transunion had no password length limitations, nor did they require my username be my email address.
Update: I have been unable to log into my account for the last 3 days now. Every time I try I get a page saying to call customer service. After a total of 2 hours on hold I finally found the issue, you cannot connect to Equifax using a VPN. In addition there is no option for 2FA (not even email or sms) and they will hang up on you if you push the issue of their security being lax. Their reasoning for lax security and no vpn usage is "well all of our other customers are okay with this".
Super long passwords aren't going to do you any good when their database is compromised and sold to anyone with a few bucks.
Its not like some one is gonna be brute forcing your account password, it would lock your account after like ten tries.
Quite the contrary.
Password hashing is standard nowadays.
When a database is compromised, brute forcing hashes is necessary to recover passwords, and the short ones are the first ones to be recovered.
So what? They'll get your single use randomly generated password months/years/decades after you've already changed it?
Which begs the question, how often do people really change their passwords unless they're forced to? This feels like the sort of thing that somebody should have studied.
If its not been pwned then why bother? As long as you're using a password generator and only using per a service passwords plus MFA youll be fine