Salt won't save you. For checking most common passwords against stolen database, you try the top one million most common passwords against each hash, at a rate of 200,000 hashes per second.

A dictionary-based attack that tries variants and inserts digits and spends one second per hash will catch the less common passwords.