Depends on the application. For an online login account, 4 might be enough (not used for anything other than login, eg, not using the same password for encrypting your data in the backend). The are rate limits and brute force blockers (though sometimes those feature can be bypassed).

For file or disk encryption? Absolutely not. Use 10 words minimum (it depends on the word list, but 10 is a safe bet across the board).