Let's not get crazy here: knowing that one of a variable number of characters is uppercase does decrease the keyspace, but it's definitely not a "significant" reduction.

The main problem with restrictions like that is that it complicates the UX by requiring somebody to tweak their password manager's generator or its output to match the bogus restriction.

Agreed on password manager, but I still think the decrease is significant. I won't run my mouth further and might try to quantify that decrease over the holidays.

I like round numbers, so lets say that we've got 26 lowercase, 26 uppercase, 10 numbers, and 18 symbols, for a total pool of 80 character options. For our single lame character, you're stuck with 26. All calculations are rounded off to make them a bit less insane to read.

Assuming a 10 character password, there are 1.07 × 10^19 combinations without the restriction, 3.5 × 10^18 combinations with the restriction.

If we're dealing with a 24 character password, like my password manager slings out, it's 4.7 × 10^45 vs 1.5 × 10^45.

As you can see, it definitely reduces the keyspace, but when you look at the overall impact it's rather small.

In both cases, the decrease you quote is about sqrt(10). It does taper off when you do a 24 character password (which is about the range of what I would choose), but it's still 30%; 70% of a large number is a large number. Typical users are not so technical as to use a 24 character password and therefore, in an unsalted leak, after the rainbow tables stage, it makes it 30% easier to brute-force them (going by your numbers).

What actually matters is not the key space when it is so vast. Without these requirements: number, special char etc, the passwords used in practice would often just be dictionary words, and a dictionary is a much smaller key space.

Maybe the best countermeasure would be to match users passwords against a dictionary,

when I worked at Barclays (it was >10yrs ago now to be fair) the enforced password policy for our internal system was "4 ascii letters + 1 symbol + 4 digits" in that arrangement (ie: abcd!1234)

you know, for security.