Entropy is really the biggest concern, and entropy is determined by the amount of randomness in your password generation process.
Let's use an 18 character password as an example. We'll look at alphanumeric characters only (62 possible characters). This gives:
log2(62**18) = 107 bits of entropy
If you decide to always convert the first 3 characters to Z to make it harder to bruteforce then you have effectively removed 3 random characters from your password, leaving you with:
log2(62**15) = 89 bits of entropy
Which is about a factor of 1,000,000 weaker. Of course, both are still absolutely and completely impossible to bruteforce, so if someone is trying to brute force your password I wouldn't worry.
Cracking strong passwords is impossible
However, it's worth emphasizing how impossible it is to brute force such a password (just in case my links didn't convince you). A top of the line MD5 hashing rig can try 200 billion hashes per second. It's blazing fast (which is why MD5 isn't supposed to be used for passwords). Even your weaker password (when you replaced the first three characters with
z) has 7.6e26 possible combinations. At 200 billion hashes per second it will only take 120 MILLION years to try all password possibilities if the password was hashed with MD5. I don't think you have anything to worry about.
The impact of
So, is it better to start with "higher" characters to make it harder for someone to brute force your password? Maybe, maybe not. If an attacker happens to start at the beginning of the alphabet then sure, yours will get cracked "faster" (although still not in this lifetime). However, there are no guarantees that someone attempting a brute force would operate in that particular order. As a result, it's impossible to guess whether or not a password starting with
aa may be more crackable. Again though, if you use a long random password, there is effectively zero chance that it will get hacked. So I wouldn't worry about it. When it comes to passwords length is king.
Kerckhoff's Principle (h/t Adonalsium)
I think that Kerchkhoff's principle is very applicable here. This is, in a sense, a core "tenet" of security. The idea behind Kerchkhoff's principle is that the security of a system should be based on one, and only one, secret/key. The idea is that the more "parts" are needed to keep a system secure, the more likely it is that some parts will get leaked and a security breach will happen. When we're talking about passwords it's quite clear what the "key" is: the password. Specifically, a long and random one. As discussed above, it's really all you need. By adding further "rules" on top of your random password you're really just giving potential hints to make it easier for an attacker who is targeting you to guess your password.