A rough estimate for using spot instances on EC2 says you can get maybe 40 trillion SHA1 hashes per dollar. (700MH/s and just under $.07/hour) So one dollar will crack a password 7 characters long. A million dollars will crack a password 10 characters long.
Switch to bcrypt and you're now at 25 million hashes per dollar on those same instances. Now you can barely crack passwords that are 4 characters long, or for a million dollars you get 7 characters.
That's if you know the salt, of course. Otherwise that gets added on to the length you're cracking.
None of this is very exact but it gets you in the right ballpark. And you can compare it to a password manager spitting out 20 character passwords that are completely immune to brute forcing.
Pro tip: Build your own GPU cluster out of consumer gear. It's orders of magnitude cheaper because GPUs for the data center are expensive and/or slow. Our commercial cracker is consumer gear in a custom built chassis in colocation. Cloud GPU just isn't there yet.
Switch to bcrypt and you're now at 25 million hashes per dollar on those same instances. Now you can barely crack passwords that are 4 characters long, or for a million dollars you get 7 characters.
That's if you know the salt, of course. Otherwise that gets added on to the length you're cracking.
None of this is very exact but it gets you in the right ballpark. And you can compare it to a password manager spitting out 20 character passwords that are completely immune to brute forcing.