Correct. They'll also start with dictionaries of a few hundred million passwords which they'll run through fairly quickly. Then they'll use mask attacks as @xim

Correct. They'll also start with dictionaries of a few hundred million passwords which they'll run through fairly quickly. Then they'll use mask attacks as @ximeng said in ascending order of length and complexity. https://hashcat.net/wiki/doku.php?id=mask_attack https://hashcat.net/wiki/doku.php?id=mask_attack So it's critically important to enforce length because short passwords will be cracked quickly even with slower hashing algorithms.