3 and 4 would not take long to be brute forced by a dictionary attack, I think. Too many people use qwerty on their password, so it's probably high rated on a dictionary attack.