Does it matter if the actual password is leaked in this day and age? I use a password manager and generate 64+ character passwords for each service.

in my personal opinion, 64 character passwords are overkill, and i absolutely refuse to put a password manager on a cellphone. That's just asking for trouble should i ever have my phone confiscated for any reason.

I use a private matrix server to send passwords from my laptop/desktop password managers to myself in E2EE channels, then delete the message. On occasion, if a password is only 18 or 20 characters (like an admin account or a single user service account) i'll type it by hand. And i use all lowercase "easy to say" passwords whenever possible. I do not believe (and never have) that adding an ampersand and a 7 to a password makes it more secure than adding "rb" to the end of a password.

> 64 character passwords are overkill

> i send E2EE passwords to my phone from my laptop or desktop using E2EE channels in a private matrix server i have and delete the messages immediately after

fair enough

Biggest problem is the API keys that were potentially/allegedly visible to a third-party or leaked. Depending on how far that goes back, if you don't have cold log storage you might not be aware of which exact keys are out there.