If you take it from the attacker perspective they won't generate all possible passwords to crack a password hash. They'll run through a dictionary of passwords

If you take it from the attacker perspective they won't generate all possible passwords to crack a password hash. They'll run through a dictionary of passwords in order of popularity trying each one. Services that rely on passwords to wrap private keys should check those passwords against known password breaches. i.e. https://haveibeenpwned.com/ https://haveibeenpwned.com/ with half a billion passwords. Then using a suitable hashing algorithm i.e. argon2id and a salt you get a high level of usability for the user and secured data.