The internet is like the wild, Wild West, but unlike the wild, Wild West which was really just a metaphor for the lawlessness and the general disrespect of the rule of law, that came about from the expansion of America and its Manifest Destiny mindset; the internet is truly global and worldwide. This means that even though America and other nations may very well have specific rules and regulations as to what is or is not permitted on the internet, and what is or is not legal, in regards to the internet, these laws have little or no standing or any effectiveness in countries that do not respect the law, or through laissez-faire attitudes care little about specific laws, or just have a plain inability or non-interest in policing its own citizens, especially if such activity does not negatively impact that country's internal power structure.
So, in effect, your password is something that may easily be considered to be "fair game" by others, in which in order to obtain your password, sophisticated programs are available for sale or usage to do such a deed. For the uninitiated or for those that don't really think about these matters, you might believe that a hacker trying to retrieve your password can only do so through the "front door", so-to-speak, that is to say, they have your email address name, or your account name, or your Facebook log-in name and now they will attempt to make an educated guess as to what your password is, based on perhaps some other information about you that they are aware of, in regards to you. The problem with this sort of attack is you only get perhaps three tries, before you are locked out, unless you also have a program that fools, for example, yahoo, into believing that each attempt that you are making to break the password is the first attempt, even though it isn't.
In most situations, in which an entity knows little or nothing about their intended target except that they want to get into their personal account, the attacker does his job much more efficiently by getting a copy of your stored and encrypted password and then attacking that offline. That is to say, through your Wi-Fi, which has been compromised or perhaps you are using a public Wi-Fi service, you will at some point type in your password to the website that you are visiting, and the attacker will snag a copy of this encrypted password. Now that the hacker has a copy of your encrypted password, through his own ingenuity and the tools of computer programs and their ability to handle and process incredible amounts of information in very short periods of time, the hacker at his leisure can begin to ply his trade. For those, that just don't believe this is possible, Eric Escobar writes: "… let's say I had an 8 character password made up of just numbers. Using my graphics card, it would take about 200 seconds--just over 3 minutes--to crack this password."
There are plenty of websites that sell programs or services that will crack passwords, while I cannot vouch for the validity of any of them, one can easily state that the business model that works best for this type of work, is one in which the service that is being sold, actually works and is effective. Further to the point, through the power of computers, the experience of master cryptologists, and budgets dedicated to tasks such as this, it is a given that many of your everyday passwords for the tasks that you commonly use can be easily broken, should someone or some agency have a deep desire to do so.