I get annoyed when websites say something like, ´Using a password of this strength will take a a hacker one million years to brute force.´

No, it’ll take a million years to try every combination and permutation of allowed characters. Chances are your password will be tried much sooner than that.