Brute forcing is just guessing what character is in each slot, so you start with aaaaa then try aaaab, etc. Using a passphrase means that there are 26 candidate

Brute forcing is just guessing what character is in each slot, so you start with aaaaa then try aaaab, etc. Using a passphrase means that there are 26 candidates. 52 if you mix upper and lower case. If you add numbers and special characters you go up to 95. Your mentor is right in that length is the more important factor. The character set has a multiplying effect whereas the length has an exponential effect, so 11 lowercase letters is 26^11 combinations, a bit over half as many as 8 special chars (95^8). It's worth noting that neither of those would be considered a "safe" password - 15 characters for only lowercase and 13 for a mix of all characters is the recommended minimum. It makes less difference when you consider that the attacker doesn't know you're using a passphrase so will probably be checking for those extra characters anyway. What does make a difference is that the passphrase is designed to be remembered but should be unique per login. So with 30+ logins you're remembering 30+ passphrases or might you be tempted to reuse some? You can get the advantages of a passphrase with a password manager but the same is not true in reverse.