Seeing as you haven't specified a Joomla version, I will assume you are referring to Joomla 3.3.
Joomla 3.3 uses BCrypt to hash passwords, inlike Joomla 2.5 which used md5 + salt
.
Here is a little nice snippet I found from yorickpeterse.com:
I'm not going to cover all the technical details but basically BCrypt requires you to specify a cost/workfactor in order to generate a password. This workfactor not only makes the entire process slower but is also used to generate the end hash. This means that if somebody were to change the workfactor the hash would also be different. In other words, hackers, you're f***ed. In order for a hacker to gain the original password he must use the same workfactor and thus has to wait N times longer than when not using a workfactor.
Therefore to answer your initial question, yes, it is probably possible to brute force, however it would take most likely years. Bcrypt is considered one of the most advances hashing techniques out there today.
You may also want to look at Joomla's built in Two Factor Autentication, which is an additional layer of security. Have a read of the following for more information:
http://www.dart-creations.com/joomla/joomla-tutorials/enabling-and-using-joomla-two-factor-authentication.html
Not additional 3rd party plugins are required.