It says 300 Gh/s for NTLM and 200 kh/s for bcrypt. There are 62^12≈10^21 12 character mixed case alphanumeric passwords. At 3*10^11 hashes/second, this would t

It says 300 Gh/s for NTLM and 200 kh/s for bcrypt. There are 62^12≈10^21 12 character mixed case alphanumeric passwords. At 3*10^11 hashes/second, this would take ~3*10^9 seconds (~100 years) to brute force. For bcrypt, an 8 character password is fine (it would take ~30 years to brute force). Of course, you have no idea what hash function a breached site may have used, so best to err on the side of caution. That said, avoiding password reuse is far more important than the strength of an individual password (not that it’s unimportant). The vast majority of breaches occur due to credential stuffing attacks on other logins, not from the initial breach itself.