Also suggests the user may be reusing the same prefix if only the changed bits are getting truncated.

Should use different random passwords every time. Completely random or a random string of words. While it doesn't solve the cleartext password storage issue, a data breach won't compromise all your other accounts to same degree.

Doesn't hurt to also randomize usernames, emails, and even security question answers.

edit: or my new favorite passkeys, just make sure you trust whatever tool is managing your private keys.