No need to brute force Facebook or most other hosted services, because very few of them store user data encrypted at rest.<p>Passwords control access to features of the web application, but employees of the company can just go around that and get the data off the server directly.<p>iPhones running iOS 8 or higher are different--they <i>do</i> encrypt data at rest, and create the key by combining device-specific info with the passcode that the user creates. So without that passcode, no chance to decrypt without brute forcing.