Can someone tell me from the technical point of view, why is :

1. Existing username + existing 8 character password = safe (I presume this is safe otherwise you won't be using the same password for n years)
2. Existing username + (existing 8 character password + random character string) = unsafe