A password is a sequence of characters chosen with repetition, so the number of possible passwords of length L from an alphabet of n characters is n to the power L. Eight lowercase letters give 26⁸ ≈ 209 billion options; allowing upper and lower case, digits and the 32 printable symbols raises the alphabet to 94 and the count to about 6.1 quadrillion.
Rules such as “must contain at least one digit” reduce the count, because sequences without a digit no longer qualify. The calculator handles any combination of these rules exactly with the inclusion-exclusion principle: start from all sequences, subtract those missing each required type, add back those missing two types, and so on.
The result is shown as an exact number, in scientific notation and as entropy in bits, together with the average and worst-case time to try them all at a guessing rate you choose. A range mode lists every length between two limits so you can see how fast each extra character multiplies the work. Remember that the figures assume a randomly generated password; a password picked by a person from words and patterns is far easier to guess.
How to use the Password Combination Calculator
- Calculate for
- Password length
- Shortest length
- Longest length
- Lowercase letters (a–z)
- Uppercase letters (A–Z)
- Digits (0–9)
- Special characters
- Special characters to list
- Require at least one special character?
- Attacker’s guessing speed
Everything is calculated in your browser, so results appear instantly and nothing you type is sent to a server.
How it works
The tool sizes each character set (26 lowercase, 26 uppercase, 10 digits and 0–32 symbols), adds the allowed ones and applies inclusion-exclusion over the required sets using exact big-integer arithmetic. Guessing time is combinations ÷ guesses per second, halved for the average case.
Worked example
Five characters from a 70-character alphabet with no rules give 70⁵ = 1,680,700,000 passwords (30.6 bits). For 8 characters from all 94 printable characters with at least one uppercase letter and one digit: 94⁸ − 68⁸ − 84⁸ + 58⁸ = 3,287,830,316,392,960 passwords, about 51.5 bits. At 10 billion guesses per second the average time to find one is about 1.9 days.
How length beats complexity
| Password | Alphabet | Combinations | Bits |
|---|---|---|---|
| 4-digit PIN | 10 | 10,000 | 13.3 |
| 8 lowercase letters | 26 | 2.09 × 10¹¹ | 37.6 |
| 8 characters, all types | 94 | 6.10 × 10¹⁵ | 52.4 |
| 12 letters (mixed case) | 52 | 3.91 × 10²⁰ | 68.4 |
| 16 characters, all types | 94 | 3.72 × 10³¹ | 104.9 |
Formula
No requirements: combinations = nᴸ (n = characters allowed, L = length) · with required character types: Σ over subsets S of the required types (−1)^|S| × (n − Σ size of S)ᴸ · entropy = log₂(combinations)
Worked example
Inputs — Calculate for: One exact length; Password length: 8; Lowercase letters (a–z): Allowed; Uppercase letters (A–Z): At least one required; Digits (0–9): At least one required; Special characters: All 32 special characters; Require at least one special character?: No; Attacker's guessing speed: 10 billion guesses/s (offline, GPU rig).
Results — Number of possible passwords = 3,287,830,316,392,960; In scientific notation = 3.2878 × 10^15; Characters available = 94; Entropy = 51.5 bits; Average time to guess = 1.9 days; Time to try every password = 3.8 days.
Key terms
- Permutation with repetition
- An ordered selection where items can repeat; there are nᴸ of them.
- Inclusion-exclusion principle
- A counting method that corrects for overlaps by alternately subtracting and adding intersections.
- Entropy (bits)
- log₂ of the number of equally likely passwords; each bit doubles the guessing work.
- Brute-force attack
- Trying every possible password until the right one is found.
Frequently asked questions
How many combinations does a 4-digit PIN have?
10⁴ = 10,000, from 0000 to 9999 – about 13.3 bits.
How many 8-character passwords are there?
With all 94 printable characters, 94⁸ ≈ 6.1 × 10¹⁵. Requiring an uppercase letter and a digit cuts this to about 3.29 × 10¹⁵ (54% of them).
How many 12-letter passwords are there?
Using upper and lower case letters only, 52¹² ≈ 3.91 × 10²⁰ – about 68.4 bits.
How long would a 16-character password take to crack?
A random 16-character password from 94 characters has about 105 bits; at 10 billion guesses per second it would take around 6 × 10¹³ years on average.
Do "at least one digit" rules make passwords stronger?
They slightly reduce the number of random passwords, but they stop users from choosing only letters. Length adds far more strength than complexity rules.
What does NIST recommend?
NIST SP 800-63B favours long passphrases, checking new passwords against lists of breached and common passwords, and no forced composition rules or routine expiry.
Why does my real password seem weaker than the calculator says?
The calculation assumes every character is chosen at random. Words, names, dates and keyboard patterns are tried first by attackers.