This question already has an answer here:
For example, OWASP considers 10-128 characters, with lower, upper, digit, and special characters (I don't get why there's an upper limit). Using the OWASP's minimum guidelines and assuming there are 28 special characters, the entropy is 3e19. But with a 16 character password with only lowercase letter is 4e22. Throw in upper case and it's 2e27. Computers can calculate at a pretty fast rate but whatever it is, it lowers that entropy, meaning that the difference isn't 22 zeros to 19, but closer to 5 to 2, i.e. the differences are huge.
If length is a concern, 12 lower + upper characters is 3e20. Other big companies still force people to use minimum 8-length with special characters. Why force people to use special characters - and to an extension numbers - when another 2 characters is not only more secure but far easier to remember? Why are they so anal about this?
Some people argue that long-length passwords are bad because people just use real words so that limits entropy greatly. To that I would say same thing with shorter passwords, hence dictionary + rule attacks. Forcing numbers and/or special characters just results in passwords like
[word]1!, or worse,
Password1!. Can someone explain either why special characters are a necessity in secure passwords or why it is considered that way despite evidence against it.