Password Combination Calculator

A password combination count describes the size of the theoretical search space when each position can contain any character from a fixed set. If a password has L positions and C possible characters are allowed at every position, the number of distinct strings is C raised to the power L. A six-digit PIN therefore has 10⁶, or one million, possible values when leading zeros are allowed. An eight-character lowercase password has 26⁸ possible strings. The calculator also converts the search space to bits of entropy by taking its base-two logarithm. One bit doubles the number of possibilities. This value is theoretical entropy: it assumes passwords are chosen independently and uniformly from the entire space. Human-created passwords rarely satisfy that assumption. Common words, keyboard patterns, names, substitutions, and reused credentials concentrate choices into a much smaller effective search space. A password manager that generates random characters is more likely to approach the estimate. Character-set size should represent the characters that are genuinely available at every position. Decimal digits provide 10 choices, lowercase English letters provide 26, mixed uppercase and lowercase letters plus digits provide 62, and the common printable ASCII range contains 94 characters. If a policy forces one symbol or prohibits certain characters in some positions, the simple power formula does not count the constrained space exactly. Likewise, passphrases selected from a word list should use the list size as the number of choices and the number of independently selected words as the length. A large combination count does not directly state how long an attacker needs. Guessing speed varies dramatically with password hashing, hardware, rate limits, account lockouts, and whether an attack is online or against a stolen hash. Attackers also prioritize likely human choices instead of checking strings in random order. Use this result to compare idealized search spaces, not to promise a specific cracking time. For practical security, generate unique random passwords, use multifactor authentication, and store passwords only with a modern salted password-hashing algorithm.