[amir734jj]

You are basically saying sha256 is prune to attack. As long as they salt the password, it should be fine.

[demindiro]

It is not. Even long/"complicated" passwords usually do not have much bits of entropy, which is why you need an expensive hash to make bruteforce attacks difficult.