Great article, thanks. I've got to comments.

a) The article seems to assume brute. The bad guys first try large dictionaries + rule based modifications before they revert to brute force. This enables them to crack much longer passwords than the graphs suggest.

b) There seems to be an error in graph for example 4 (md5 vs. bcrypt): The curve for bcrypt and md5 have different shaps above, but they should have exactly the same shape, only shifted to left/right.
This is because f * a^c = a^(c + log_a(f))
f: factor by which md5 is faster than bcrypt
a: character set size (e.g. 26)
c: password length