Is there any benefit to *really* strong passwords? Suppose you had these two passwords:

password_one = "Z;$]bnNvY3I-Ww]R4qm7PpiE/@y9Qz$cNk{d3"
password_two = "4tjDqq])G-^u:PT~X]QBTa,XqUk[o9`(p?iC`w8*)*T9t\@l+^+U04m@_8CXV:E7L\R]\&gt;N6M.0E|%Ud_f*]bN*rn^;FX7\M%5t?"


It seems to me that they are both strong. Is password_two harder to crack than password_one?

I guess this depends on what sort of hashing is involved. What if Bcrypt or sha512 are used, would there be any benefit for using password_two?
I'll assume those were generated by selecting characters independently and uniformly at random, out of a set of 95 characters.  Entropy is the base 2 logarithm of the number of equiprobable choices, so each character chosen independently at random contributes $\log_2(95) \approx 6.6$ bits of strength to your password.  So the strength of password_one is about $37 \times 6.6 = 244.2$ bits.  

That's already stronger than any cryptographic key will ever realistically need to be—it's comparably strong to a 256-bit key.  It's strong well past the point where the choice of password hashing algorithm is relevant; if people could be reliably counted on to memorize passwords this strong, we wouldn't need such algorithms.  People choose terrible passwords; the often-cited XKCD password strength comic famously pegged passwords like Tr0ub4dor&amp;3 at about 28 bits, and even that is likely much better than average.

That means that your password_one is, arguably, total overkill, because:


Passwords need to be user-friendly.  For example, they need to be convenient to type or input into one's device.
If your password is this crazy strong, that just means that your weak point is somewhere else, and it's likely way, way weaker than the crazy password.  You're well past the point of diminishing returns.


If you're just a regular Jane or Joe who is not subject of special interest by spy agencies and such, I think 80-bit(ish) strength passwords are plenty strong enough for website logins; a 12 character random ASCII character password (e.g., Z;$]bnNvY3I-) is at about this level, and much more convenient than what you're doing.  For password-based encryption you could consider going up to about 128-bit strength.