There's an XKCD about this, actually:

http://xkcd.com/936/

In essence, the all-lower-case password is in fact more secure than passwords of mixed cases, assuming the mixed-case password is shorter. Many people don't really understand password strength. It's assumed that mixed-case passwords are stronger than same-case passwords because mixed-case passwords add more variability.

But password strength can be measured in terms of 'information entropy,' the amount of randomness they contain. As a crude example, a password like 'aaaa' contains almost no entropy, whereas '3?/vdZ' contains high entropy. The greater the entropy, the harder it is to break a password, all other things being equal.

The "all other things being equal" part is important, of course. A high-entropy password that's very short is easy to crack; a low-entropy password that's 28 characters long is hard to crack. So cryptographers will talk about the number of bits of entropy a password has--that is, the total measure of possible randomness in the password. There's an equation you can use to determine the entropy in a password, which is in the Wikipedia article on the subject:

http://en.wikipedia.org/wiki/Password_strength#Entropy_as_a_measure_of_password_strength

Password evaluation systems that just look for certain criteria (like "Does it have mixed case? Does it have numbers? Does it have punctuation?") will not necessarily give the same results as evaluation systems that calculate the entropy of the password.


Photo gallery, all about me, and more: www.xeromag.com/franklin.html