It all depends on entropy as seen in @Yuriko's link but also on a related concept: the basis.
The entropy is a concept coming from thermodynamics. It basically represents the number of possible states reachable by a given system. In practice, in the computer-security realm, it is related to the number of combinations ("states") that exist, that is to say, the number of possible passwords one has to try before guessing correctly.
For instance, take your 23-letter password. Using only the 95 ASCII printable character, the attacker would need to try at most 2e45 passwords to correctly guess it. This value (2 followed by 45 zeros), is directly related to the entropy we are talking about. If that value goes up (because you added one character in your password for instance), the entropy goes up which means that your password becomes stronger.
This is the exact reason why you can hear that people should use longer password, not complex-to-remember ones.
The concept of basis comes from algebra. Without going into much details, the basis represents the available building blocks to represent a system. In practice here, the basis is your password building blocks: the available letters.
For instance, I've just written about "95 printable ASCII characters". This is a basis: to create a password, your are allowed to use letters from those 95 letters. Another basis could be "the 26 lowercase basic letters" or the "52 upper and lowercase basic letters" or "the set of lowercase letters minus 'l' and 'o' with all the numbers".
The basis can be even more complex:
Your password must be composed of a series of existing words.
Your password must be at least 8-character long. It must be composed of alphanumeric characters plus ':', ";" or "!". It must contain at least one uppercase letter.
can also be expressed as a basis.
The minimal basis is the smallest basis that can be used to express the password that the attacker wants to guess. In our case, the minimal basis for your password is a set containing your password only. :)
However in the case of a real attack, this is exactly what we want to know. Yet attackers will choose a basis that is deemed large enough but not too large in order to avoid expensive calculations.
Now let's imagine that the attacker uses the basis "all the 26 basic lowercase characters" to crack your password, it would require at most 4e32 (4 followed by 32 zeros) guesses to be sure to get your password. Even at a testing rate of 1 billion passwords per seconds, it would still be quite safe.
Now let's imagine the attacker uses the basis "common english words" (2000), then it would require at most 3e16 guesses, which can be done within a year.
This is one of the reasons why some people still recommend to force the use of a larger minimal base by imposing rules at password creation time. That means that if you are using a basis element (character, word, etc.) that is not included in the basis the attacker chose, he just cannot guess your password. That means that the only attackers able to find your password would need to use a larger basis which will require a lot more time.
Strong enough password
Now I guess that you understand the relationship between the entropy and the basis: the larger the basis, the larger the entropy. Said otherwise, the entropy is related to:
(basis size)^(number of basis elements)
The whole point of the XKDC comics is to understand that increasing the basis size is something our brain is not good at: the result seems more random but it is not (and it is generally harder to remember).
To paraphrase what the author already said, take an 8-character password: it will be 2000 faster to try all the possible combinations if the attacker knows that the password is made of "the 26 lower case letters and 10 numbers" than if he thinks there can be any ASCII characters in it.
In comparison, just add 3 extra character to the original password and you already are 20 slower than the 8-character ASCII password.
Most password cracking programs contain a statistical analyser (or the results of previous analysis). The purpose of this kind of code is to adapt or tweak the attackers minimal basis to the human mind and habits.
For instance, most people capitalize the first letter of their password when they have to. This is so common that this is tested in priority. Most people who use words as basis elements tend to create sentences. Some letters are more likely followed by some other letters, etc.
To avoid that and get the maximal entropy out of your password (and therefore the strongest passwords), you need randomness to defeat all these statistical attacks.
This is one thing that your current passphrase lacks.
Should I include capital, digits, etc?
- If it is easy for you, why not: this contributes to increasing entropy and it forces the use of a larger attack basis set, which are good things.
- If it is not easy for you, just add a new word to the mix and you would get roughly the same effect on computing times.
- However you should make your password more random.
A few warnings:
- I have always talked about "time to test all combinations" or "would require at most...": this is the realm of statistics. There is a probability that you guess right at your first try, second try, etc. There are remarquable values that people throw like the square root of the number of combinations (birthday paradox should ring a bell here). However these are useless for qualitative discussions like this one.
- I have always talked about quantities "related" to entropy: these are not directly entropies but they are easier to understand.