It depends. The old method of cracking passwords was a dictionary attack. You take every 6 or 8 letter word, and all the O->0 i->1 etc variants, calculate the

It depends. The old method of cracking passwords was a dictionary attack. You take every 6 or 8 letter word, and all the O->0 i->1 etc variants, calculate the hashed password and store them. In this case having a 64character pass phrase makes the dictionary impractical. As did having a random "$^FD^$@l^" type passwd. The newer technique is to use a GPU or FPGA and simply try all possible 6 or 8 char strings and calculate the hash in real time at a billion tries/second. This means the random gibberish is no better than "passwd". So even if you do have the full text of "war and peace" as your pass phrase there will be a shorter string that hashes to the same value and the GPU will find this collision first. Remember it doesn't need to find your passwd - just an equivalent one.