The password server should be in a special box that throttles requests.
There is no passive defense that can save you without creating new problems. A slow server is a DDoS-able server. We already do things like rate limiting, but it can also be a problem. Therefore we use active threat detection and selective blocking.
That way no hacker can run gajillion retries on a password without swiping the actual box.
It's not wrong to want to put your authorization server on a link that's too dumb to hack it through, but what about local logins? We have good reasons to protect our password databases.
Anyhoo the best kinds of passwords are phrases with subtle errors or small random changes, and the best policy only forcing changes rarely unless a breach is known or suspected. Making them longer is the only thing that really helps make them more expensive to break, after keeping them secure in the first place, and the more easily people are allowed to memorize them, the less likely they are to need to write them down.