SHA256+random salt goes at about 10e9 hashes per second on a workstation with a good GPU. That's enough to do a permuted dictionary attack that will get the overwhelming majority of passwords in a system.

[edit]

Does anyone know if the bitcoin ASICS have been repurposed as SHA256 crackers? md5 and sha-1 are more common in password storage, but if you use what the parent suggests, then it could be worse since there is so much specialized SHA256 hardware out there.