Just a couple dry facts seem to work the best, pick the top three, or maybe show a live example. I've used jacktheripper against NTLM hash in front of an audience and cracked the password "Pass!" in seconds before their eyes, this received good response.

Whenever someone wants a reminder about password strength, I send them to xkcd

http://imgs.xkcd.com/comics/password_strength.png