from my university website:
8-14 chars long
“some combination of” letters and numbers and at least one special char (e.g., +, @, #, or $)
The following characters can NOT be used: _ ` & !
and then it goes on with the usual caveat about dictionary words and no prior passwords, etc.

I’m wondering whether I can use the /really/ special chars like ß, ☺, ½, etc?

from my financial institution:
8-15 chars long (not case sensitive), Aa-Zz, 0-9, -, _
at least one letter, one number, no spaces.

So they allow the dash and underscore, but nothing else.. seems a little pointless. OTOH, if I accidentally enter the wrong password even once, I get an email saying so. I don’t know why more sites aren’t doing this.

There are 208,827,064,576 passwords 8 characters long, consisting only of lower case letters.

There are 642,544,814,080 passwords 8 characters long, consisting of 7 lower case letters and one number.

(That’s 208 billion vs. 642 billion).

It is easier to brute force when you have set limits, but even in the case of any character being allowed, the overwhelming majority of passwords will still only be alphanumeric. By forcing people to use a symbol in their passwords, you are increasing the range of characters that will be in the typical person’s password. So in almost all cases, it will be harder to brute force.

Just my 2 cents.

PS
I agree that they are harder to remember though.