3 ms·

Depends how they're stolen. If a site that wasn't using unsalted hashes for storing them was hacked, then it doesn't matter how guessable they are.