3 ms·

But there are only a few suspect passwords, you can just know all of them, and thus reliably differentiate.