How long would it have taken to crack the secret on that same setup if HMAC-SHA256 had been used instead? What's the recommended minimum number of bytes for an

How long would it have taken to crack the secret on that same setup if HMAC-SHA256 had been used instead? What's the recommended minimum number of bytes for an HMAC secret when using SHA1? SHA256?