For judging complexity I always thought large businesses should just set aside some compute to try to brute force passwords with the hash. If they get yours, yo

For judging complexity I always thought large businesses should just set aside some compute to try to brute force passwords with the hash. If they get yours, you have to change it and get a talking to. If they can't get it, they give you $X where X is big enough to be a pleasant surprise.