If you want to cheat at complexity you can look at the most common mechanisms for brute force and their defaults. For example, the publicly available rainbow ta

If you want to cheat at complexity you can look at the most common mechanisms for brute force and their defaults. For example, the publicly available rainbow tables are mainly built for US character sets. If you're using characters that aren't in those character sets the rainbow table lookup will fail (as the hash wasn't precomputed). Likewise, if dictionaries (and the permutation rules) lack a non-standard character, using that character will defeat the dictionary attack. If you use a straight brute force then there's a trade off between the characters you use and the amount of time it'll take to exhaust a particular set of characters. It's only if the attacker is determined (and has usually exhausted alphanumeric character set brute forces) that you'll start to see other characters being added to the brute force. The great thing of course is that the attacker has to pretty much start from scratch with another set of permutations for each additional character.