There's also quite some difference in the used hardware (CPU vs GPU vs specialized hardware), and in the algorithms. E.g. MD5 (not a crytographic algorithm) will be cracked in seconds, whereas e.g. SHA256 will take way longer. Depending on used algorithm you can also crack the whole database at once, or have to crack each password new. The whole thing isnt easy.
Rule of thumb: 10 is okay-ish (although probably not for a very long time), 20 will be impossible.
Edit: cannot find what i wanted, but this https://nakedsecurity.sophos.com/2015/09/10/11-million-ashley-madison-passwords-cracked-in-10-days/ gives a quick idea about the differences.
Rule of thumb: 10 is okay-ish (although probably not for a very long time), 20 will be impossible.
Edit: cannot find what i wanted, but this https://nakedsecurity.sophos.com/2015/09/10/11-million-ashley-madison-passwords-cracked-in-10-days/ gives a quick idea about the differences.