I've yet to see anyone link to a source

Here is where I'm getting my info

https://cybersecuritynews.com/nist-rules-password-security/

You haven't provided any evidence to support your claim. Online accounts can't easily be brute forced.

If a hash is leaked you just change the password. As long as you aren't reusing the same password everywhere you are fine.

I'm not sure how you expect someone to brute force a web service. It is possible but it would be equivalent to a denial of service. Having long passwords for a online login makes no sense. A randomly generated 12 character password isn't any more or less secure than a 40 character password since they both take a unrealistic amount of time to brute force.

A 12 character password made up of standard characters would take 475,920,314,814,253,376,475,136 tries assuming you know the length. I don't see how someone could brute force a web service.

I will say I get annoyed at web services that require special characters since I like to use 3 words from the EFF extended word list.

How old are you?

The old security wisdom has been thrown out in favor of better practices. If you spend to much time focusing on one spot you will make everyone hate you while leaving gapping holes in your security.

Also https://xkcd.com/538/

I love wordlists

At a certain point it doesn't matter as the password is effectively unguessable.

One weakness with longer passwords is that if they are created by humans chances are it will be easier to guess the pattern. This is true for all human created passwords but I think the longer ones are worse since there is more space to create a easily guessable pattern.

As long as the adversary doesn't have the ability to brute force the password locally, you have the ability to reset in the event of a leaked hash and you aren't reusing passwords you are fine with a shorter password. Obviously be mindful of easily guessable passwords or ones that are very short. However, a 12 digit sufficiently random password is fine. Don't fall into the trap of longer but easier to guess.

Don't do things like impossiblebatman1. Something like SalariedOverhand22 or imposiba1ttman

The first secure one I used diceware to generate two random words and then a random number generator to add a number. The second one I randomly changed spelling and the pattern to increase entropy.

It won't matter if you use a password manager. You shouldn't rely on the website to keep your password safe. They could be storing it in plain text for all you know. (It has happened before)