Well OK but not all passwords are hex numbers! Given that testing a few simple classes the length of the shorter one takes about a second or two then that seems worthwhile.

It's been a while since I fired up John the Ripper but it has low hanging fruit modes built in.

So even if you are using quite long simple alphanum strings of gibberish then seriously consider adding one or more character class into the mix eg capitals and easy to identify special chars like $£% etc.

To really go for gold why not mix entire scripts eg the usual en_* alphabet and say Bulgarian Cyrillic. Gasp as your keyboard mapper explodes! Alternatively, look into MFA.

Yeah -- I assumed that a random hex password was chosen, and that the attacker does a brute force hex search (e.g. JtR with Incremental:LowerNum). Granted, in practice the attacker usually doesn't know the exact format, so they might waste additional time searching other formats.

I agree about incorporating other characters. As long as it's not "Dictionaryword1!" :) https://youtu.be/aHaBH4LqGsI

Maybe Bitcoin needs a “proof of proof of work” now. If some entity wanted to brute force an attack on the worlds passwords, the increased electricity and heat would be detectable. But they could hide the activity it inside Bitcoin mining. A proof would be needed.

How long would it take to crack P@55wordMarch!

5ae2b1ce4999dfd2 is about 10^19 options.

Most passwords will come from a set of around 100 characters (52 letters, 10 numbers, about 35 symbols on my keyboard). An 8 character password would be 10^17 options.