Dictionary attacks are actually hard. Think about the entropy.
Take a "complex" 8-char password: 26 letters (x2), 10 numbers and some symbols. Let's say each character has 100 possibilities, over 8 characters.
My simple maths gives me about 10,000,000,000,000,000 possible combinations.
Now compare to a 4 "word" passphrase. The Oxford English dictionary
contains 171,476 words.
That comes to 864,596,308,417,753,067,776 possible combinations. That's just 4 words.