[dspillett]

> "jdtwbv" hashed using scrypt is stronger than "H.W8Jz&r3" hashed using MD5*

But "password" is still grossly insecure in either case, it'll still be the first thing that someone performing a dictionary attack will try. Never tell people how good your key derivation function is, lest they misunderstand and think it means they don't have to chose a non-obvious password/passphrase.