Password Combination Calculator
Enter a password length and choose which character types are allowed to instantly see how many possible passwords can be formed. The calculator also shows entropy in bits, how long a brute-force attack would take at typical speeds, and a plain-English strength rating. The results update as you type.
Formula
Worked example
A 12-character password using lowercase (26), uppercase (26), and digits (10) has a pool of 62. Combinations: 62^12 = 3.226 x 10^21 (about 3.2 sextillion). Entropy: 12 x log2(62) = 71.5 bits. At 10 billion guesses per second, cracking every possibility would take about 10.2 thousand years.
How password combinations are calculated
The number of possible passwords is a permutation with repetition problem. At each position in the password, the attacker has N choices, where N is the size of the character pool. With L positions and N choices per position, the total number of combinations is N raised to the power L. A pool of 62 characters (a-z, A-Z, 0-9) and a length of 8 gives 62^8, which is about 218 trillion combinations. Adding just one more character multiplies the count by another 62, so length is the single most powerful lever you can pull.
What is password entropy?
Entropy measures the unpredictability of a password in bits. The formula is E = L x log2(N), where L is the length and N is the pool size. Each bit of entropy halves the fraction of the search space an attacker has already covered. At 40 bits, a fast attacker with a trillion guesses per second can exhaust all possibilities in about a second. At 80 bits the same attacker would need around 38 years for worst-case coverage. At 128 bits the time exceeds the age of the universe. Security professionals commonly target 80 bits as a practical minimum for general accounts and 128 bits for long-term cryptographic keys.
Character pool size and what it means
The character pool is all distinct characters that could appear at any position. Lowercase letters alone give 26 characters. Adding uppercase gives 52. Adding digits gives 62. Adding the 32 standard ASCII symbols (such as !, @, #, $, and %, among others) brings the total to 94. Every toggle you enable multiplies the number of combinations by the added characters raised to the power of the password length. Symbols are especially powerful: switching from a 62-character pool to a 94-character pool for a 12-character password increases the search space by a factor of about 53.
Attack speed and crack time
Crack time depends entirely on how fast the attacker can test guesses. An online attack against a live login page is usually rate-limited to thousands or at most millions of guesses per second. An offline attack against a copy of a leaked password database, especially one that uses a fast but weak hash like MD5, can reach billions or trillions of guesses per second on modern GPU clusters. The crack time this calculator shows is the worst-case time to exhaust every possibility in the search space. In practice, attackers use dictionaries and rule-based mutations first, so a common word with substitutions can fall much faster than its entropy alone would suggest. Use a random passphrase or password manager to avoid dictionary-vulnerable patterns.
Entropy strength benchmarks
| Entropy (bits) | Strength rating | Use case suitability |
|---|---|---|
| Below 40 | Very weak | Not suitable for any account |
| 40-59 | Weak | Only for low-value, disposable accounts |
| 60-79 | Moderate | Acceptable with rate limiting and MFA |
| 80-99 | Strong | Suitable for general-purpose accounts |
| 100-127 | Very strong | Suitable for financial and sensitive accounts |
| 128+ | Exceptional | Adequate for long-term cryptographic use |
Widely used thresholds for evaluating password entropy. Actual security also depends on rate limiting, hashing algorithm, and whether the password appears in a breach database.
Frequently asked questions
What is the formula for password combinations?
The formula is C = N^L, where N is the number of distinct characters in the pool and L is the password length. For example, a pool of 94 characters (all printable ASCII) and a length of 12 gives 94^12, which is about 4.76 x 10^23 combinations. This grows extremely fast with length, which is why adding characters to a password is more effective than swapping one character type for another.
How many combinations does a 4-digit PIN have?
A 4-digit PIN uses only the digits 0-9, giving a pool of 10. The total combinations are 10^4 = 10,000. With a single attempt every second, an attacker could try all possibilities in under three hours. Modern phones lock out after a small number of incorrect attempts, which is the main defense for PINs, not their mathematical search space.
How long should a password be to be secure?
For a pool of 94 characters (mixed case, digits, and symbols), 12 characters yields about 74 bits of entropy, which is strong enough for most accounts. For particularly sensitive accounts, 16 characters gives around 98 bits, and 20 characters approaches 123 bits. If you restrict to lowercase only, you need at least 18-20 characters to reach 80 bits. Using a password manager to generate and store fully random passwords is the most practical way to achieve both length and randomness.
What is the difference between combinations and permutations here?
In everyday password security, the calculation uses permutations with repetition, meaning order matters and characters can repeat. The formula N^L reflects that. A true combination (order does not matter) would massively undercount the search space and is not the right model for passwords. Every distinct ordering of the same characters is a different password, so all positions count independently.
Does a higher number of combinations guarantee my password is safe?
A large search space is necessary but not sufficient. If your password is a common word, a keyboard pattern like "qwerty", or has already appeared in a data breach, an attacker will find it using a dictionary or breach list before ever reaching the random part of the search space. Always generate passwords randomly rather than choosing them yourself, and check them against known breach databases using services like Have I Been Pwned.
Why does entropy matter more than the raw number of combinations?
The raw count of combinations grows exponentially and quickly becomes a number too large to compare intuitively. Entropy in bits compresses that into a linear scale where each additional bit doubles the search space. This makes it easy to compare passwords of different lengths and pool sizes, and to apply practical thresholds: 80 bits for everyday accounts, 128 bits for cryptographic use. The numbers in this calculator can reach trillions of trillions, but 80 bits is always a concrete and comparable target.