Additional character requirements do increase security.
When you write a program to try every possible combination, special characters, numbers and capitalization requirements all increase the combination set you have to run through.
The problem is it's fucking pointless because a 10 letter password is unbreakable. A super computer may be able to break a hundred digit password in a matter of minutes, but if the super computer is 10ms across the internet, it might as well be a 486. It would be over 30 years just to try every combination in a numeric password, you'll be dead a thousand years before a 10 letter password gets hacked over the internet, barring revolutionary leaps in networking that remove latency from the equation.
https://howsecureismypassword.net/
Sites like this seem to think you're going to be using the login server to crack the passwords.
Now if you used a dictionary word, well... There's only a couple hundred thousand after all, even over the internet a password that weak can be broken. Then again, any system worth a damn should be doing a lockout after 3 failed attempts in a row. If something is trying to log in four hours straight, they have bigger security problems than password strength.
Where it will matter is when they get hacked.
