It depends on several factors. Primarily, how are the passwords stored?
The current best practices are to use a key stretching algorithm. The NIST specifically states using key derivation algorithms that are like PBKDF2 and Balloon (13th paragraph, 220.127.116.11, not counting the bulleted list as a paragraph). The community typically lists PBKDF2, bcrypt, scrypt, and Argon2, with PHP providing bcrypt and Argon2 for its
The link for Argon2 is to its white paper. Between this and the NIST standards, these are hopefully citable documents, and the Argon2 white paper includes additional citations.
The reasoning behind making their use a best practice, is these methods have configurable difficulties, and an administrator setting up the authenticator for their system should tune their chosen method to make brute-force guessing prohibitively expensive.
If the cost is tuned to require enough work for a processor core to be tied up for a full second, this has little impact on, for example, a web server that occasionally handles authentication. A user can be reasonably expected to wait for a second, and other users will be minimally impacted, as many web servers have multiple cores.
On the other hand, a naive attacker will only be able to guess one password each second, per core, and some key stretching algorithms specifically target features that make (expensive) memory more valuable (Argon2, scrypt), or make parallel processing, such as with multiple GPU cores, much slower (Argon2, bcrypt). While a dedicated attacker will generally have more resources to devote specifically to brute force verifying passwords, they would still only be guesses tens of passwords per second, rather than the millions or billions of guesses possible with modern ASICs attacking hash algorithms.
If the passwords are stored as just salted hashes, though, there exists hardware that is especially suited for a very similar task, and it would take very little to design an ASIC that performs comparably: Bitcoin miners. While a hash guesser would probably be far more expensive on a per-unit basis, due to the economies of scale that Bitcoin miners enjoy, a single $2,400 unit can perform 14 trillion bitcoin hash guesses per second.
General purpose GPU-based attacks against hashes and common password encryption/obfuscation systems that don't use properly configured key stretching algorithms can typically make millions to several billions of guesses per second, depending on the algorithm, as shown in the benchmarks that Luc linked in a comment.