In theory, passwords are random combinations of words and/or characters so you cannot 'guess' larger than a character at a time. This scales very quickly to th

In theory, passwords are random combinations of words and/or characters so you cannot 'guess' larger than a character at a time. This scales very quickly to the number of combinations. http://www.oxforddictionaries.com/us/words/the-oec-facts-about-the-language http://www.oxforddictionaries.com/us/words/the-oec-facts-abo... You can guess 90% of the words in the OEC with only 7,000 words in your rainbow table. I suspect that is a pretty fair representation of e-mails text. Even if it is the 1,000,000 number... [As of 2011, commercial products are available that claim the ability to test up to 2,800,000,000 passwords per second on a standard desktop computer using a high-end graphics processor.] http://en.wikipedia.org/wiki/Password_strength#Password_guess_validation http://en.wikipedia.org/wiki/Password_strength#Password_gues... So ya. If it is a per-word hash, there is no real security value if you have the salt.