Password Combination Calculator

About the Password Combination Calculator

Password security depends mainly on length and character pool size. A password of length L drawn from a pool of P characters has P^L possible combinations, so each extra character or larger character set can expand the search space quickly.

This calculator reports total combinations, entropy in bits, and an estimated brute-force crack time for a chosen mix of lowercase letters, uppercase letters, digits, symbols, or custom characters. It is useful for comparing common policy choices and seeing which ones actually increase resistance to guessing attacks.

The output makes it easy to tell whether a password is long enough to matter or only looks complex on paper.

When This Page Helps

Password rules often focus on symbol requirements even though length usually contributes more entropy per added character. This page makes those trade-offs visible so you can compare policy options with actual numbers instead of intuition.

How to Use the Inputs

1. Enter the password length.
2. Check the character sets to include (lowercase, uppercase, digits, symbols).
3. Optionally add custom characters.
4. Set the brute-force speed for crack time estimation.
5. Or click a preset for common scenarios (PIN, standard password, strong password).
6. Review the total combinations, entropy, and estimated crack time.
7. Compare how length and character pool affect security.

Example Calculation

Tips & Best Practices

• Length matters more than complexity. A 12-char lowercase password (26^12) has more entropy than an 8-char alphanumeric password (62^8).
• Every additional character multiplies combinations by the pool size. Going from 8 to 12 characters makes the password ~14 million times harder to crack.
• The entropy scale: <28 bits = trivially crackable, 40-60 bits = moderate, 80+ bits = strong against offline attacks, 128+ bits = virtually uncrackable.
• Modern GPUs can try 10+ billion hashes per second for weak hash functions like MD5. Use bcrypt/scrypt to slow this down.
• Password managers eliminate the trade-off between security and memorability — use long random passwords.
• These calculations assume truly random passwords. Real human-chosen passwords have much less entropy due to patterns.

The Mathematics of Password Security

Password security is fundamentally a combinatorics problem. P^L total possibilities means an attacker must try, on average, P^L/2 passwords. The logarithmic measure (entropy = L × log₂P) lets us compare passwords across different pool sizes and lengths on a uniform scale.

Why Length Beats Complexity

Each additional character adds log₂P bits of entropy. For alphanumeric (P=62), each character adds ~5.95 bits. Going from 8 to 12 characters adds 23.8 bits — that's 2^23.8 ≈ 14.8 million times harder to crack. Mandatory symbols increase pool from 62 to 94, adding only log₂(94/62) ≈ 0.6 bits per character — negligible compared to adding length.

Real-World Attack Scenarios

Online attacks (rate-limited to ~100/sec): Even a 6-char alphanumeric password survives ~18 years on average. Offline attacks (10 billion/sec): need 80+ bits for adequate security. State-level attacks (custom hardware, 10¹⁵/sec): need 100+ bits. The attack speed determines the security threshold.

Frequently Asked Questions

• How many combinations does a 4-digit PIN have?

  10^4 = 10,000 combinations. At even 1,000 attempts per second, all PINs can be tried in 10 seconds. PINs rely on lockout mechanisms (e.g., 3 attempts then lock) rather than combinatorial security.

• Is a longer password always better?

  For random passwords, yes — each additional character multiplies security. But human-chosen long passwords often use predictable patterns ("password123456") that don't provide the full theoretical entropy.

• What is entropy in the context of passwords?

  Entropy measures the number of bits needed to represent all possible passwords. 40 bits = 2^40 ≈ 1 trillion combinations. Higher entropy means more guesses needed. It's computed as length × log₂(pool size).

• Why is 1 billion guesses/sec used as default?

  Modern GPU-based cracking (using hashcat) achieves billions of hashes per second for common hash functions like SHA-256 or MD5. For bcrypt with cost factor 12, it drops to ~thousands per second.

• Do special characters really help?

  Adding symbols increases the pool from 62 to 94 chars (51% increase). But adding 2 characters of length (keeping 62-char pool) multiplies combinations by 62² = 3,844. Length usually wins.

• What makes a password truly secure?

  Randomness and length. A 16+ character random password from a 62+ character pool provides 95+ bits of entropy. Combined with a slow hash function (bcrypt, Argon2), this is effectively uncrackable even with nation-state resources.