TL;DR XKCD solved this problem a decade ago, and somehow most of the industry still hasn't caught up.

Still a good read, BTW.

So we always assume passwords were unsalted? Or can they also brute force salts?

This blog posts makes some weird assumptions. One that especially stood out to me was that when writing a password, someone would only capitalize the first letter. What? Its probably more common, but its definitely not the only letter someone would capitalize. There's a few other assumptions like that, and I'm not sure where they're coming from.

how about openssl rand -hex 50 B)

I am still doubtful of these password strength "reasoning" blog posts of which there are hundreds.

There seems to be no real information regarding dictionary attacks and how that effects password solve times, but it seems like passphrases would be more susceptible to it. I am definitely no expert.

I briefly talked to a friend of a friend at a dinner who is in digital cyber security and she said that AI has pretty much changed the game and can guess any word-based passwords strings like the famously quoted xkcd comic orders faster than traditional methods, and hackers are using that now but it hasn't had as much academic research yet. Maybe that is only for unsalted passwords though.