Is a very long plain text password harder to crack than a short complicated password?
Usually when we talk about "hard to find" we are talking about brute force guessing. This is where the attacker just keeps trying different passwords till they find the right one. I'm going to assume we're talking about this model here and not talk about the real world with hashing and rainbow tables and so forth.

Now, there is nothing inherently different about trying a 5-character random string versus trying a 4-word password. They are both equally easy for a computer to plug in and see if they work. Instead, the question is how many guesses you need to find the password, i.e. how hard is it for an attacker to guess your password.

Now, an important question is what the attacker knows about your strategy of picking passwords.
We usually want to make the worst-case assumption that the attacker knows our method for picking passwords. Under this key assumption, we can compare the two methods.

If we pick a 5-character password uniformly at random from all strings containing a-z,A-Z,0-9,!@#\$%^&amp;*()-_+={}[];:'"|\,&lt;.>/? then we have something like $92^5 \approx 6.6$ billion possibilities. So the attacker has a one in $6.6$ billion chance of guessing it on the first try, and so on.

If we pick 4 random words uniformly from a set of say 500 words, then we have $500^4 = 62.5$ billion possibilities. So in this example, the attacker is worse off trying to guess a 4-word random passphrase than a 5-character random string. Notice that the example is really assuming that we do this random process for picking passwords, i.e. we run a computer program that takes a list of 500 words and (using good randomness!) spits out a sequence of 4 random words.

Also notice that both of these examples assumed that the attacker knows your strategy. If the attacker is first going to try all 4-word passphrases, and then all 5-character strings, then you would rather have a short random string because it will take longer for that attacker to guess. But since you don't know what the attacker knows, you're best off assuming they know what type of passwords you use, but they don't know which one you picked. And by "type" of password, I really mean a method of generating that password, like uniformly random 5-character strings. Thinking about this method, as we did above, tells you how random or hard-to-guess it is.