Minimum input size of a hash function This is a theoretical question, to improve my understanding of hash functions. Hash functions have a one-wayness such that they are protected from the first preimage attack. From my understanding, if $H(X)=Y$, knowing $Y$, I should not be able to know $X$ is the fundamental behind the first preimage attack.

The question: Does the security of a hash function from the preimage attack also depend on the secrecy of the length of $X$?

If the adversary knows the length of $X$, then it can easily brute force $X$ for smaller lengths of $X$. I understand that smaller length of $X$ will get appended and pre-processed into larger blocks but that does not stop the adversary from brute-forcing since there are no secrets in the pre-processing.
The questions



Does the security of a hash function from the preimage attack also depend on the secrecy of the length of X.?


The preimage attack: given a hash function $h$ and a hash value $y$ the computationally bounded adversary tries to find a pre-image $x$ such that $y = h(x)$.
This is like an adversary trying to find a password given the hash of it with the known hash function. Note that one doesn't need to find the actual input value for the success of the pre-image attack. Any password with the same hash value will be work for the adversary.
There is no known practically successful pre-image attack on any cryptographic hash functions, even those that are practically broken with collision attacks like MD5 and SHA-1. There is a pre-image attack on MD5 that requires $2^{123.4}$ complexity by Sasaki and Aoki Finding Preimages in Full MD5 Faster than Exhaustive Search in 2009. This is still far from practical usage though it is faster than direct searching.
To hash a value one needs to apply the standard encoding of the message that includes the padding mechanism so that the hash fits into the block size of the hash function. NIST defines them for their standards. The block size can be like 512 bits in SHA256 or 1024 bits in SHA512.
If ever we find a successful pre-image attack, it will also reveal the size of the found pre-image and that was not necessarily the input used to generate the hash value. The padding mechanism, however, can prevent some attacks. Usually, the adversary has lots of freeness for the attack since hash functions can hash any size. This is used in SHA-1 collision attack (identical-prefix collision attack). If the size is limited, that can be a big problem too.


If the adversary knows the length of X, then it can easily brute force X for smaller lengths of X. I understand that smaller lengths of X will get appended and pre-processed into larger blocks but that does not stop the adversary from brute-forcing since there are no secrets in the pre-processing.


If the message space is small, then the adversary simply brute-forces all possible inputs. The current computational capabilities of the adversaries can be evaluated from public information. For example, the bitcoin miners reached $\approx 2^{92}$ SHA-256 hashes per year on 06 August 2019.
During the candidate input generation and testing the hash value, the adversary will also apply the padding mechanism.
for each candidate in [0..2^t]
    paddedCandiate = pad(candidate)
    if hash(paddedCandiate) == y
       return candidate

where $t$ is the predetermined bound. This search space can be easily parallelized by dividing space into segments.
The padding mechanism is not a secret and nothing to do with the secrecy of the mechanism. In unkeyed hash functions, there is no secret.
If you fear that your small input space is vulnerable, you might look at keyed hash functions like HMAC, KMAC.