Common std::string
implementations don't allocate on the heap if the string is short enough (this is called the "short string optimization" or "SSO").
Since the exact amount of characters that can fit into SSO (if any) depends on the implementation, you probably shouldn't rely on it, or should at least research how the big 3 standard libraries handle this.