I started writing a response, but then it got too big. Basically the 5 second timeout is a bad idea because its implementation is not worth the effort. http://oim.ae/gx8qMD for the reasoning.

But the other thing, use UTF8 high value characters. Or simply learn Russian and use a password from russian words.