Speaking to easy hashes (NTLM, MD5, OpenLDAP SHA, etc.) One through four brute force is extremely trivial. A single core CPU will do all those in less than a m

Speaking to easy hashes (NTLM, MD5, OpenLDAP SHA, etc.) One through four brute force is extremely trivial. A single core CPU will do all those in less than a minute. Five (all combinations... the entire space) in less than an hour. Modern GPUs can enumerate the entire six char space within a day or so. Some GPUs can enumerate the seven char space in a few days. Complete enumeration begins to get infeasible when you get into the eight char space. This is basically why CPUs are still viable. Speed won't get you nearly as far as intelligence will (append stuff onto the end of words). Nothing against speed here and if it was a pure enumeration race, then no doubt, go with GPUs. Edit: When I say "entire space" I mean the entire printable ASCII character set. Edit2: It's rather simple to calculate too. 95 printable ASCII chars to the power of the password length. So, to enumerate the four char space, it's 95^4 (81,450,625). You can "do the math" for any lenght password. But you'll see that when you hit eight chars (6,634,204,312,890,625) that even GPUs (which can do billions of hashes a second) have to be smart and not just fast.