Not really a valid comparison. Doesn't work for xkcd/diceware style "correct horse battery staple" passwords. Doesn't work if you through HaveIBeenPwned passwor

Not really a valid comparison. Doesn't work for xkcd/diceware style "correct horse battery staple" passwords. Doesn't work if you through HaveIBeenPwned password searching into the mix. Doesn't work if you do the standard password variation mechanisms such as employed by Jack The Ripper. And once you get to those longer passwords with all random characters and which cannot possibly be memorized by 99.999% of the population, you're well into password manager territory and then you've got a different threat model you've got to be concerned about.