A typical home computer in 2004 could brute-force a 40-bit key in a little under two weeks, testing a million keys per second; modern computers are able to achieve this much faster.
40-bit encryption was common in software released before 1999, especially those based on the RC2 and RC4 algorithms, when algorithms with larger key lengths could not legally be exported from the United States without a case-by-case license.