SHA-256 exhaustive search How do I calculate the number of computations needed to break SHA256 in case we are using it for safely storing passwords (together with a salt)?
Are there any formulas that can be employed? 

For example:


  Passwords are chosen to be 5-character strings composed of lowercase Latin letters and numbers, and are stored as SHA256(password XOR s)||s, with s chosen as a 5 byte array filled with random content.
Possible password search space = $36^5$ = 6.05 million possible combinations or ~$2^{26}$.  If the passwords were randomly generated it would be 26 bits of entropy which isn't just weak it is pointless.

To put that into perspective the throughput on modern GPUs is on the order 1 billion SHA-256 hashes per second.  So the exhaustive search time to break an account would be 60ms.  An attacker could break about 60,000 accounts per hour.

Rainbow tables are a non issue as you are using per record random salt.  It is too short to be fully effective but given how weak it is generating the rainbow tables would take far longer than just breaking all the accounts.