zxcvbn: one guess per second