Right, but with a well-written distributed brute force application, it could probably get through a lot of password cracking. No need to break AES-256.