And it takes a week for 9 characters and a few hours for 8. The point is that with a random salt the amount of work that needs to be done is proportional to the

And it takes a week for 9 characters and a few hours for 8. The point is that with a random salt the amount of work that needs to be done is proportional to the number of accounts you want to break across all services, not just one. It isn't a ton of additional security (especially if an email account is compromised...why is everything so terrible), but it is strictly better and doesn't have failure modes like the same username being used in a billion devices.