content: I think the argument is more along the following lines. Let's define complex passwords as those that meet the common requirements of having letters of both cases, numbers, and special characters. Security experts were/are attracted to this because it makes brute force guessing much harder. It also makes a lot of obvious bad choices such as dictionary words impossible.  Hackers are getting smarter though and learning to augment dictionary attacks with the kind of token efforts people make to fulfill these password requirements. So your use of P@ssword1 may not be as foolproof as you thought.  It's unclear how much real unpredictability people are adding.