17 ms·

I know Halifax at least uses a separate string for those checks, which presumably is stored unencrypted.