There is a very nice article on the strength of passwords on Info World by Roger Grimes. Below is a paragraph from the article.

Most professional password guessers know there is a 50 percent chance that a user’s password will contain one or more vowels. If it contains a number, it will usually be a 1 or a 2, and it will be at the end. If it contains a capital letter, it will be at the beginning, followed by a vowel. The average person has a working vocabulary of 50,000 to 150,000 words, and they are likely to be used in the password. Women are famous for using personal names in their passwords, and men opt for their hobbies. “Tigergolf” is not as unique as CEOs think. Even if you use a symbol, an attacker knows which are most likely to appear: ~, !, @, #, $, %, &, and ?.

The complete article can be found here.