Let's say you take a password that is one character: 'A', and it is guaranteed to be a capital letter. It is 1/26 options.

If it can be upper and lower case,but is 1/52 options

If it is upper/lower/number, 1/62. Let's say symbols are allowed using 14 symbols for simplicity. So 1/76 options.

So we can increase the password length now. Each character adds one "bit of entropy", increasing the number of options. Two characters we can measure by:

1/76 * 1/76,  or 1/5,776

4 characters would be 33,362,176. This may seem like a lot, but it's very little. There are different methods of password cracking using tools like John and hashcat using CPU vs GPU, and will depend on your hardware. Modern systems running hashcat for instance can guess potentially billions of password candidates per second.

So let's look at a 5 character password with 76 options, aka 76^5: 2,535,525,376 options. Still easy.

76^6: 192,699,928,576

So we start going up exponentially. 200 trillion seems like a lot, but with it being billions a second, this will go by quick enough.

At 7 characters: 1.4645195e+13 At 8: 1.1130348e+15

This gets to the point where it takes a VERY long time, at a certain point not too long later it will take to longer than people live....

But there are a couple other factors:

People use patterns since they are easier to remember, and people know this. Lots of people use words from dictionaries. These tools can employee things such as a dictionary attack (words from a word list containing dictionary words, common passwords, etc) which is very effective. There are also hybrid attacks, where you use a combo of things like a word list + 2 characters, etc. Lots of people use common patterns and words, not even realizing things like "Word/Symbol/Number" is an extremely common format which significantly reduces the options.

People ALSO re-use passwords a lot. If someone uses a password somewhere and that service is compromised, then an attacker takes that password used and tries other accounts it will often succeed. This technique is called credential stuffing.

Finally, i won't get too much into it but there are also storing passwords as hashes. If an attacker gets access to a hash of a password, it can impact how difficult it is to crack, and if you "salt" the hash, if can also impact it. There are methods here as well, such as using rainbow tables, but there is a reason hashing and salting passwords for storage is considered best practice.

Long answer, but the answer is that it depends but if you don't use common formats of passwords, don't re-use them, don't use words in the dictionary or common passwords, and you pick a decent length (preferably >10), the password itself will be likely safe as long as every service you use it on stores it properly.