password1 and reasonable mutations of password are probably present in the top 10000 passwords. If that's not the case in general, a good benchmark would be 'c

password1 and reasonable mutations of password are probably present in the top 10000 passwords. If that's not the case in general, a good benchmark would be 'can hashcat break this given a reasonable mutation pattern'. The zxcvbn project pretty much provides that.