> then not having to go through the first 1-8 set will save you a tremendous amount of time... Well, not quite. If you allow say capital letters and numbers on

> then not having to go through the first 1-8 set will save you a tremendous amount of time... Well, not quite. If you allow say capital letters and numbers only (36 different characters), and you have to go through all 9 and 10 character passwords, skipping the first set of 1 to 8 character passwords saves you less than 0.1% of the work, if my rough back-of-the-envelope calculation is correct. That was precisely what my statement was about - longer passwords are just so much better. (Note that this assumes that the cost of computing the hash is by and large independent of the length of the password, which is a very good assumption for the lengths we are talking about here).