Is the sum of permutations of disjointed sets larger than the count of permutations in their union? My wife and I are having a bit of a disagreement.
Concerning eight-digit passwords like the kind most secure websites require, she believes you could generate more unique password combinations by using only one of the following sets: one lowercase or one uppercase or one symbol or one numeral. In other words, if you created a password using only lowercase letters with no other conventions. e.g.: jtpdlrkc or JTPDLRKC or 29456014 or #^@%#&(%.
I have asserted that, by using at least one each of the aforementioned sets, a person can generate FAR, FAR more unique password combinations, thereby making the password much more difficult for someone to hack. e.g. gy7HU*j9 or $F6ms38@.
She thinks I'm making this up. I need numbers to prove my point.
Anyone interested in running with this one?
 A: I'll let the binomials and the factorials, and the jokes on who's right between husbands and wives, to the other responders.  They are useful and fun, but let's take another viewpoint.
The rules that restrict the choice of passwords have two aims:


*

*Make sure that there is a large enough pool of passwords to choose from.

*Make sure passwords people choose are reasonably spread out in that pool.
To increase the number of possible passwords, you'd increase the maximum length of the password and you'd allow more symbols in each position.
But this is not what you see in the rules: your password must be at least eight characters long, and must contain at least one character from each of these groups.
The reason is that, without those constraints, too many would choose "fido" or "1984" as their passwords.  This would make the task of those who want to break into accounts way too easy, because they could focus their efforts on the (few) commonly used passwords.
So, those "distribution requirements" actually decrease the number of available passwords, but greatly improve the way they are spread out.
Now, you don't see any site requesting that your password be all lowercase or all uppercase or all digits, or all symbols for two reasons: the important one is that almost all users would go for alphabetic passwords.  The other is that in fact, there would be fewer passwords to choose from (for long enough passwords).
A: There are $26^8=208,827,064,576$ lower-case passwords, the same number of upper-case passwords, $10^8=100,000,000$ digit-only passwords and (if we assume there are about ten symbols) about $10^8$ symbol-only passwords as well. That gives your wife about $418,000,000,000$ possible passwords.
We get a simple lower bound for the number of passwords having all kinds of characters: We can use any character for the first five places, that's $(26+26+10+10)^5=1,934,917,632$. If no upper-case was used so far, add an upper-case. If no lower-case was used so far, add one lower case. If no digit was used so far, add one digit. If no special was used so far, add one special. (At most three of these conditions can be true). As long as we still have less than eight characters add one of the 72 allowed characters. This method will not generate all valid passwords, but there will be at least $10\cdot 10\cdot 26$ possible choices in the last three places. Multiply with the above to arrive at 
$5,030,785,843,200$, more than ten times the other count.
A: I realize that this is a Mathematics stack and that my answer is primarily non-mathematical. However, I feel that the question’s subtext concerning password strength deserves an answer from the flip-side.
If attackers used purely randomly generated passwords, they would have the same probability of guessing your password, your wife’s password, some person’s ‘12345678’ password, provided they are of the same length and use the same symbol set. Several other answers have already shown that the sample space of 8-character passwords is very large. Attackers would be better off making money or having fun buying Lotto tickets.
What it comes down to in the end is the predictability of a password. Alas, targets are far more predictable than they think. Attackers commonly use dictionary attacks, which essentially is the application of a set of known password distributions to better their chances. They may further apply tailored dictionary attacks, based on information acquired through social engineering, online presence, profession, hobbies, geographic location, etc. It all depends on the purpose of the attack.
Consider that your wife’s password is one of a million other passwords nabbed from some online retailer. Not only will attackers have a list of encrypted passwords, but also account information, which can be used to apply more specific cracking strategies. In such cases, it is no different than the old bear joke. Bob and Joe are startled by a bear while camping. Joe puts on his sneakers.  Bob says, ‘What are you doing? You can’t outrun a bear!” Steve replies, “I don’t have to, I just have to outrun you!”
Attackers generally have a quota to fill. The brute strength of your wife’s password just needs to be stronger than others till the quota is reached. At that point, passwords are used to commit more serious cybercrimes. No time is spent cracking more passwords because attackers are working against the clock, since their nefarious activities will unveil the security breach eventually, hopefully sooner than later. Stopgap measures thereafter will invalidate any newly discovered passwords. Then again, if illicit activities are stealthier, they may have more time.
Consider that the attack is more focused. Your wife is the sole target or part of a smaller set of targets such as her fellow employees. The purpose is most likely not for immediate financial gain, but for information warfare. In such cases, attackers will spend more time and be far more resilient in their efforts to discover her password. Your wife has already given such would-be attackers an advantage by letting it be known that she uses a restricted character set. If attackers “acquired” both your encrypted passwords and knew that tidbit of information, they have a high probability of success cracking your wife’s password than yours, despite that both of you drew your passwords from the same sample space.
To avoid giving attackers the favor, your wife should come up with a different “formula” and tell no living soul about it, even you. Furthermore, while the brute strength of her password is still important, it is more important that it is also immune to social reverse engineering. In other words, composed of something that is as orthogonal as possible to the known set of information that attackers could discover about her. The easiest solution is to use a random password generator. A better solution is to use simpler, longer, multi-word passwords, i.e. passphrases, that can be remembered by mnemonic devices; obviously, this is system dependent.
It is difficult to measure the extract strength of a password. The most common measure used is the password's information entropy. Borrowed from Shannon’s work in information theory, the entropy measures the number of information bits provided by a password. A password with an entropy of 50 would require 250 attempts to exhaust all possibilities in a brute force attack. For example, your 8-character password picked from the standard 94-character symbol set, would have an entropy of 18. If the password passes an extensive dictionary test (by the system), it gains an additional 6 bits, for a total of 24. The bonus of a dictionary test declines as the password length increases. A phrase such as spider came to see ms muffet on a tuffet has an entropy of 56.
If you are interested in finding out more about password entropy, these following National Institute of Standards and Technology (NIST) papers provide a wealth of detail:


*

*Estimating Password Strength

*Appendix A: Estimating Entropy and Stength (pg. 103) NIST SP 800-63-2, Electronic Authentication Guideline
A: There is a context in which the wife is right, which may explain her intuition.  Suppose we split the permitted symbols into two sets, $S$ and $T$, of size $s=|S|$ and $t=|T|$.  Suppose further that our password must be exactly two letters long.
The wife's strategy yields $s^2+t^2$ passwords, either two from $S$ or two from $T$.  The OP's strategy yields $2st$ passwords, either one from $S$ then one from $T$, or the other way.  
The wife's strategy will give at least as many passwords as the OP's, because $(s^2+t^2)-2st=(s-t)^2\ge 0$.  Indeed,  if $s\neq t$, then the wife's strategy gives strictly more passwords.
