The attacker wouldn't need to know the padding pattern, consider the following
The padding is done client side
Attacker scripts and posts directly to the server
The attacker reverse engineers the client front end and adds that padding to the script they are writing to post requests to the server, the complexity generated by appending the padding has been lost, and the complexity remains as if the padding did not exist. on average an attacker would still need approximately $ \frac{n^L}2 $ attempts to brute force the password, Where $n=|\{\Gamma\}|$, and $L$ is password length.
Attacker uses the web UI
The Attacker does not notice that the padding exists, It can be brute forced with little consequence. The attacker would still make $ \frac{n^L}2 $ attempts on average to guess the correct password. again, the padding did nothing
The padding is done server side
If the padding is added on the server side then the attacker wouldn't even know the padding exists. You would not change the complexity of brute forcing the password. Adding a salt
is a common technique, but it is not to prevent this attack, It is to prevent an attacker from creating a rainbow table. [note]: for your question a rainbow table is out of scope.
If the attacker gets the database
[NOTE] this is an edit when I wrote this post I did not bother to mention this section because I found it irrelevant, this is to address a comment!
If the password database is not salted.
The attacker may look for repeats in the database to identify places where a dictionary attack can be used. When that fails the attacker is going to suspect something is up, select an account from that list and execute the same dictionary attack, Only this time they post requests directly to the server until the base password can be identified. Now the attacker knows the problem and has two options.
Option one:
Start decoding the padding, in strait up brute forcing and look for a pattern.
Option two:
They have access to the server storing the passwords, They likely could have pulled the authentication application, they may reverse engineering it and identify the padding pattern!
Now an attacker would construct a rainbow table
The few people that care about security would be ignored, and anyone with a week password is compromised.
If the password database is salted
Honestly, this is out of scope, but if It's salted then an attacker would likely move on to an easier target. This is not because the padding added any security, the salt just made it a waist of time, cracking one password wouldn't crack other passwords. I say that assuming their is not a specific target, if their is then the adversary likely has the resources to deal with brute forcing that one individual, assuming the target is not technically savy.
End edit
Setting a max length
This is just a bad idea, Lastpass can generate a 99 digit password that no one is going to brute force, commonly if someone sets a max length it is around 32 bytes, I attempted to set a password yesterday and I had to generate a second password.