The required complexity of a password depend on application. A well constructed web site should limit the number of login attempts, thus making a quite simple password relatively safe. In a lot of other applications however an attacker is only limited by computing power, therefore a more complex password is required.
The limits given are rough estimates, there is no way to calculate an exact boundary for sufficient complexity as it is never possible to completely preclude the possibility that an attacker gets lucky. It is however possible to make a complex enough password that this possibility is negligible. If in doubt, use a more complex password.