How this instrument works
A password built from a character set of size n, at a fixed length of length characters, has exactly n^length possible values. Each character position can independently be any of the n available characters — lowercase letters, digits, symbols, whatever the set includes — and nothing about an earlier character restricts what a later one can be, so the count multiplies out to n raised to the power of length. That total is the brute-force search space: the number of distinct passwords an attacker with no other information would need to be prepared to try before being guaranteed to hit the right one.
The two inputs pull in the same direction but at very different rates. Widening the character set — adding uppercase letters, digits, symbols on top of lowercase — multiplies the total by a fixed factor for every position, so it helps, but linearly with the character-set size. Adding one more character to the length multiplies the entire total by n all over again, so length grows the search space exponentially rather than linearly. That asymmetry is why security guidance consistently treats an extra character or two of length as worth more than a modestly larger symbol set: an 8-character password from a 26-letter set already reaches roughly 209 billion possibilities, and stretching that same alphabet to 12 characters pushes the total to about 95 quadrillion — roughly 457,000 times larger, from adding just 4 more characters.
Total possible passwords is often converted to bits of entropy — log₂ of the total — because it's an additive measure that composes cleanly: doubling the search space adds exactly 1 bit, and independent randomness sources add their bit counts together. A search space of n^length corresponds to length × log₂(n) bits, a number worth knowing because it's the figure password-strength meters and cryptographic guidance are actually built around, rather than the raw combination count itself.
- Enter the number of distinct characters the password could draw from into Character set size — 26 for lowercase-only, 52 for mixed-case letters, 62 adding digits, 94-plus once common symbols are included.
- Enter the password's length in characters into Password length.
- Read Possible passwords beneath the inputs — the full brute-force search space, computed as charset size raised to the power of length.
- To compare two policies fairly — say, a longer password against a wider symbol set — run each through the instrument separately and compare the two totals directly.
- This figure assumes every position is chosen freely; a password built from a dictionary word has a far smaller effective search space than this raw count, since a smart attacker never has to search the whole space.
Worked example — an 8-character lowercase password
An 8-character password drawn only from the 26 lowercase letters has a character set size of 26 and a length of 8. Enter charsetSize = 26 and length = 8. Each of the 8 positions independently has all 26 letters available, so the total is 26 raised to the 8th power: 26^8 = 208,827,064,576. Possible passwords reads 208,827,064,576 — nearly 209 billion distinct lowercase-only passwords of that length.
That figure is the full space an attacker with no other information would have to search to guarantee a hit by brute force alone; it says nothing about how quickly any particular attacker could search it, only how large the space itself is. Mixing in uppercase letters and digits (a 62-character set) at the same length instead pushes the count to 62^8, about 218.3 trillion — the search space grows because a wider set means more choices at every one of the same 8 positions.
Questions
What does this calculator actually measure?
The total number of distinct passwords possible for a given character set size and length — the full brute-force search space, computed as charset size raised to the power of length. It is a count of possibilities, not an estimate of how long an attack would actually take, since that depends on guessing speed and strategy, which this instrument does not model.
Does adding length or widening the character set help more?
Length, by a wide margin, because it's an exponent rather than a multiplier. Widening the character set multiplies the total by a fixed factor once; adding one more character to the length multiplies the entire total by the character-set size again. An 8-character lowercase password has about 209 billion possibilities; extending it to 12 characters (same 26-letter set) pushes that to roughly 95 quadrillion.
Why does this assume characters can repeat?
Because real passwords allow it — nothing stops "aaaaaaaa" from being a technically valid 8-character password. Each position is chosen independently from the full character set regardless of what earlier positions hold, which is exactly the n^length pattern; if repetition were forbidden the count would instead shrink at each position, following a permutation-without-repetition formula.
Does a big search space mean a password is actually hard to guess?
Only against a pure brute-force attacker trying every combination blindly. Real attacks often guess smart rather than exhaustively — trying dictionary words, common substitutions, and previously leaked passwords first — so a password built from a predictable pattern can have a huge theoretical search space here while still being one of the first guesses an attacker actually tries.
How does this relate to bits of entropy?
Total possible passwords converts to entropy with log₂(total), or equivalently length × log₂(charset size), since n^length in bits is exactly that product. Entropy is the additive form of the same figure — password-strength guidance is typically phrased in bits precisely because bits add cleanly across independent sources, while raw combination counts multiply.
How is this different from the permutation-with-repetition calculator?
Mathematically identical — both compute n^r. This instrument applies that formula specifically to password strength, labeling the inputs as character-set size and password length and framing the result as a brute-force search space; permutation-with-repetition uses the same formula for general ordered-sequence counting, like PIN codes or binary strings, without the security framing.