Estimating time with dictionary attacks would be hard because, well, you have to have a dictionary at hand to see how far down the list the word is. Personally

Estimating time with dictionary attacks would be hard because, well, you have to have a dictionary at hand to see how far down the list the word is. Personally, I would make a list of the top 1k or 10k most common passwords and assign a very low number to them. Say, a few seconds max. For any password that is not on the list, get the subset of characters used (upper+lower case, lower case+numbers, symbols+numbers, etc); raise it to the power of the password length to get number of possibilities; multiply by a random number (<= 100) and divide it by the FLOPS of a retail computer. Don't forget to display it at the nearest time unit (seconds, weeks, years). Absolutely naive and a bit too rough around the edges, but good enough to send the message.