I'm trying to gauge password strength assuming that the attacker has a hash of my password. Can anyone cite some realistic contemporary rates at which someone could perform various hashes? I know most sites use unnecessarily weak hashes like MD5 of SHA-1, so rates for these would be the most relevant.
For a simple invocation of MD5 or SHA-1, a realistic rate is between 1 and 10 billions of passwords per second. That's what can be achieved with a good GPU. Furthermore, if the hashing is not salted, then the attacker can share the effort between several attack sessions, usually using precomputed tables (e.g. rainbow tables): an attacker, somewhere, had to hash gazillions of possible passwords once, but then the resulting tables can be applied to thousands of hashes with only a small cost.
If the hash function is proper (as described in this answer), then it uses a slowdown parameter which makes the function as slow as can be wished for. Slowness impacts both the defender (the honest server who uses the hash to authenticate users) and the attacker. We could imagine, for instance, that the defender is ready to invest 10ms worth of his own CPU on each hashing instance, which means that the defender can handle 100 password hashes per second. The attacker can throw more PC at the issue, with multiple cores, and possibly use specialized hardware (GPU, FPGA...), which may give him some boost; let's say that the attacker can be 100 times more efficient at the password hashing than the defender, leading to brute force performance of 10000 guesses per second.
The boost that the attacker can obtain through specialized hardware depends on the function (e.g. a GPU will be good for attacking PBKD2/SHA-256, not as much for attacking bcrypt). How much hardware the attacker will be able to throw at the problem also depends on external parameters (his budget, his motivation...). The slowness used by the defender is a trade-off, because increased slowness uses server resources and may make it more vulnerable to denial-of-service attacks.