Vault password requirements

Thanks for your replies. Using case, numbers, and symbols draws from more of the ASCII character set than just lowercase letters, so such a password would appear to be stronger, but its real strength depends on how brute-force cracking algorithms work. If they start by analyzing strings of length 1 to n of lowercase letters and only then begin adding other character subsets, then a lowercase password will be easier to crack, provided it’s not longer than n. But if I’m using a 30-character lowercase string, it would seem to me to be less likely to be cracked by a hacker than a 15-character password that uses more ASCII subsets. Is that correct?

Thanks. Basically, I guess it’s a question of a longer passphrase consisting of real words that are easy to remember but not to guess—so no song lyrics or common quotes—vs a shorter password consisting of randomly generated characters. Of course, randomly chosen words with some addition of other ascii characters—such as “2tonic”—would be best, and presumably it’s not a bad idea to mix languages, but I have to have a vault password that’s easy for my partner and me to remember, so randomness needs to be minimal. Any suggestions of practices that would meet those criteria would be greatly appreciated. 

Interesting approach. Thanks! The solution I’m considering to my original question in this thread (What are Norton’s vault password requirements?) is to come up with a passphrase we like, and if Norton rejects it, do as few modifications as possible to make it work—e.g., to use a bad example, if “thequickbrownfoxjumps” doesn’t satisfy a Norton complexity requirement, maybe “The quick brown fox.” would. Does anyone have any additional further suggestions or advice?