1 · You choose — the password
2 · The site chooses — how it's stored
Each +1 doubles the work — for the attacker and for the login page.
3 · The attacker chooses — the hardware
They already have your password file. This is the part you can't control at all.
The answer
——Read the three panels again. You picked the password. Someone else picked the hash, and someone else picked the hardware. Change only panel 1 and the answer moves a bit; change only panel 2 and it moves by a factor of a billion. Password strength is mostly not the user's decision — which is why "use a strong password" is advice to the wrong person.
What about quantum computing?
The common belief: a quantum computer tries every password at once and picks out the right one. It doesn't. Nothing does. What Grover's algorithm gives you is a quadratic speedup on unstructured search — roughly the square root of the work. In the unit that matters, it halves the number of bits:
Grover reduces the number of guesses, not the cost of each one. A deliberately slow hash multiplies every single guess, and that multiplication survives quantum untouched — so bcrypt's work factor is as useful against a quantum attacker as against a GPU. The defence you already had is the defence you'd still want.
The thing quantum genuinely breaks is a different thing. Shor's algorithm factors large numbers efficiently, which kills RSA and elliptic-curve cryptography: key exchange and digital signatures, not password hashes. That is what post-quantum standards such as ML-KEM exist for, and why "harvest now, decrypt later" is a real worry for recorded traffic. It is not a worry for the password file — there, the answer is simply more bits. There is no such thing as a "quantum-resistant password hash"; there is only a longer password and a higher work factor.
And no machine capable of any of this exists. The figures above are a theoretical ceiling that ignores error correction — currently thousands of physical qubits per usable logical one — and ignores that Grover parallelises badly, so an attacker cannot buy their way forward with more machines. Meanwhile the cloud farm in panel 3 is rentable this afternoon for about the price of lunch. Worry about these in that order.