It's significantly more difficult to reuse the base and figure out the additional characters than it is to get access to the user whose password is 'password'

For insecure services that I use on mobile, public, etc computers, I do this.