15 chars limitation

[epixoip]

However as the passwords on that list are only the ones that were found, I wonder how many of the "not found" hashes were > 15 characters in length?

precisely. what that table really demonstrates is the likeliness of a long password being cracked with current methods and software.

it's not that users aren't selecting long passwords, it's that we aren't cracking them. yes, the majority of users select a password 6-8 characters long. but with each leak there's always that 10% we cannot crack. and with all these highly-publicized leaks lately, it has reminded people that they need to choose longer passwords.