Start with all 
-character strings: 
Then remove all passwords with no lowercase (
), all passwords with no uppercase (
), all passwords with no digit (
) and all passwords with no special character (
).
But then you removed some passwords twice. You must add back all passwords with:
- no lowercase AND no uppercase:
- no lowercase AND no digit:
- no lowercase AND no special:
- no uppercase AND no digit:
- no uppercase AND no special:
- no digit AND no special:
But then you added back a few passwords too many times. For instance, an all-digit password was remove three times in the first step, then put back three times in the second step, so it must be removed again:
- only lowercase:
- only uppercase:
- only digits:
- only special:
Grand total: $95^8 - 69^8 - 69^8 - 85^8 - 62^8 + 43^8 + 59^8 + 36^8 + 59^8 + 36^8 + 52^8 - 26^8 - 26^8 - 10^8 - 33^8 = 3025989069143040 \approx 3.026\times10^{15}$
Answer from Thomas Pornin on Stack ExchangeVideos
How to create a strong password with 8 characters?
How to create a password?
What is a good password?
Start with all -character strings:
Then remove all passwords with no lowercase (), all passwords with no uppercase (), all passwords with no digit () and all passwords with no special character ().
But then you removed some passwords twice. You must add back all passwords with:
- no lowercase AND no uppercase:
- no lowercase AND no digit:
- no lowercase AND no special:
- no uppercase AND no digit:
- no uppercase AND no special:
- no digit AND no special:
But then you added back a few passwords too many times. For instance, an all-digit password was remove three times in the first step, then put back three times in the second step, so it must be removed again:
- only lowercase:
- only uppercase:
- only digits:
- only special:
Grand total: $95^8 - 69^8 - 69^8 - 85^8 - 62^8 + 43^8 + 59^8 + 36^8 + 59^8 + 36^8 + 52^8 - 26^8 - 26^8 - 10^8 - 33^8 = 3025989069143040 \approx 3.026\times10^{15}$
The answer I get is 0.3051925477389360000E+16 = 3,051,925,477,389,360. This answer is taken from the answer at Derive an algorithm for computing the number of restricted passwords for the general case? . This problem is more difficult than it appears. 
is not the right answer. (26)∗(26)∗(10)∗(33)∗(95)∗(95)∗(95)∗(95) is not the right answer and you can't just multiply this product by the number of permutations. This is because if for example the punctuation special character first appears in the fifth position in the password with the first lower case letter, first upper case letter, and first digit appearing in the first 3 positions of the password then there are only 
characters that can appear in the fourth position of the password. Because of this problem a different approach is necessary. An approach that gives the right answer is done by summing as follows:
The number of passwords for permutation 
with password positions j1, j2, j3, and j4 is
.
gives the number of passwords corresponding to permutation, 
.
$$Total=\sum_{k=1}^{24} S(I_k)$$ gives the total number of passwords satisfying the requirement. The algorithm for computing the number of passwords meeting the requirement is more completely described at the web site indicated above.
I'm rolling out 2FA and encouraging users to use passphrases. With that in mind, I am thinking of doing a 14 character minimum with no complexity requirements that doesnt expire. This seems to follow NIST's recommendations except they encourage an 8 character minimum. This doesnt seem to jive well with their passphrase recommendations. What kind of passphrase would be 8 characters long? Microsoft also recommends 8 characters and says that anything more than 10 characters will encourage users to use insecure work-arounds like "fourfourfourfour" for their password.
Would an 8 character password with no complexity requirements pass your sanity check?