The XKCD comic assumes the attacker has 1000 guesses per second, but a single GPU box on a stolen hash can easily hit a couple billion guesses per second. So the security model of the comic is extremely optimistic compared to some completely reasonable and common threat models.
Fortunately the readme on the target page appears to show the tool defaulting to passwords of considerably higher security than demonstrated in the comic which ought to provide reasonable security under a broader set of attack models.
Fortunately the readme on the target page appears to show the tool defaulting to passwords of considerably higher security than demonstrated in the comic which ought to provide reasonable security under a broader set of attack models.