Services like CAPTCHA are intended to solve different problems, like protecting your web service against DoS or bot/spam attacks. To brute force crack a passwo

Services like CAPTCHA are intended to solve different problems, like protecting your web service against DoS or bot/spam attacks. To brute force crack a password, you would really need direct access to the digest. We are talking around the order of 2^80 attempts before finding a collision with a algorithm like SHA-1. Checks need to happen very fast. Doing this through a web interface is already too slow to be feasible from a time perspective. So really, cracking passwords is only a consideration when someone gets a hold of all your digests (eg. your database) and can crunch away on them locally for a long time.