You can actually calculate an upper-bound cost for cracking your passwords via offline attacks. This is how.