About ten or fifteen years ago it would be with rainbow tables, but these days you can run hash crackers on GPUs. A couple of breaches over the years allowed the collection of millions of hashed passwords which have now been cracked, so combine the hash cracker software with the database of cracked hashes and, whilst it still isn’t trivial, it’s not rocket science either to reveal passwords. Passwords need to go the way of the dodo, we need a better security solution.

Have I been pwned is a very useful resource.

This article is a little out of date, but it explains everything really well.