However, the length of the average password is probably closer to 8 chars (http://www.codelord.net/2011/06/18/statistics-of-62k-passwor...) at which point the time to crack a password drops to 84 minutes for SHA-1 and 30 minutes for MD5. Also if users aren't required to use uppercase or special characters, they probably won't (http://research.microsoft.com/pubs/74164/www2007.pdf), at which case things look a lot worse.