My nextcloud instance uses fail2ban and I use a >32bit strong password.

Assuming I lose my phone and my laptop and my personal computer and my nextcloud instance I would be screwed.

Since I host my own mailserver I would be able to create a new mailserver with a new password though and recover any accounts with a new email.