I think password requirements have probably made this true for most people. You can show mathematically that requiring numbers and a lowercase and uppercase and so forth is actually less protection than having a longer password. If I had a lowercase 20 character password, it would be way more powerful than a 10 character password with a variety of characters – at least when it comes to brute force attempts.

(Let’s say there’s 10 special characters, so you get 26+26+10 = 62 possible characters per slot. For a 10 character password, there’s 62^10 possibilities, approx 8.4E17. All you’ve got for the lowercase password is 26 possible characters per slot for 20 total characters, or 26^20 possibilities. That’s approx 2E28 possibilities.)