> But in practise nobody uses 100 character long strings.

Multiple websites I use daily have that length of password or longer.