Password strength is usually measured in bits of entropy -- roughly, how many guesses an attacker would need to try before finding your password by brute force. A longer password with a smaller character set can have more entropy, and therefore take longer to crack, than a shorter password stuffed with symbols.
Why length wins
Each additional character multiplies the number of possible combinations, while adding a new character type (say, requiring at least one symbol) only multiplies it by a small constant factor once. Four random dictionary words strung together are typically far harder to brute-force than an 8-character password with a capital letter, a number, and a symbol -- even though the second one looks more 'complex' to a human reading it.
Where complexity rules actually help
Character-type rules exist mainly to block the weakest passwords -- things like 'password' or a plain first name -- not to meaningfully strengthen an already-long password. They also push people toward predictable patterns, like capitalizing the first letter and adding '1!' at the end, which trained cracking tools already account for. A password's real resistance to guessing depends on both its length and how unpredictable it is, not just which character types it contains.
The bigger real-world risk for most people is password reuse across sites, not insufficient entropy in any single password -- a breach at one site instantly compromises every other account using the same password, regardless of how strong that password looked in isolation.
A practical approach
Use a long, unique password or passphrase for every account, generated randomly rather than invented, and store them in a password manager rather than trying to memorize variations. The password entropy calculator shows the actual bit-strength math behind a given password, and the strength checker flags common weak patterns beyond just length and character count.