Work out brute force attempts instantly with clear inputs, formula shown and shareable results.
A password drawn uniformly from a charset of size C at length L has C^L possible values and L x log2(C) bits of entropy. An attacker expects to find it after searching half the keyspace, so average time is C^L / (2 x guess rate). Guess rates vary enormously by hash: billions per second for unsalted MD5 on a GPU cluster, a few thousand per second for bcrypt at cost 12.
Brute-force time
keyspace = C^L; entropy = L x log2(C); average time = C^L / (2 x guesses per second)
No. Real attackers use dictionaries, leaked-password lists and rule-based mangling first, which break human-chosen passwords far faster than brute force. This is the upper bound for a truly random password.
Match it to the hash. Modern GPUs manage hundreds of billions per second against MD5 or SHA-1, but only tens of thousands against bcrypt, scrypt or Argon2 with sound parameters.