[snowwrestler]

No need to brute force Facebook or most other hosted services, because very few of them store user data encrypted at rest.

Passwords control access to features of the web application, but employees of the company can just go around that and get the data off the server directly.

iPhones running iOS 8 or higher are different--they do encrypt data at rest, and create the key by combining device-specific info with the passcode that the user creates. So without that passcode, no chance to decrypt without brute forcing.