Password Combination Calculator — Password Strength & Entropy
Find out how many unique passwords are possible for a given character set and length, measure the entropy in bits, and see how long a brute-force attack at 1 billion guesses per second would take.
Character repetition
Total unique passwords of this length from this character set
- 1
Character set size (n)
62 - 2
Password length (r)
8 - 3
Combinations = nʳ
62⁸ = 218,340,105,584,896With repetition each position is independent, giving n choices r times.
How does this calculator work?
Possible passwords = n^r (with repetition) or n!/(n−r)! (without), where n is character-set size and r is length. Entropy = log₂(combinations). A 12-character mixed alphanumeric+symbol password has ~78 bits of entropy, requiring ~40 billion years to brute-force at 1B guesses/s.
Formula
How this is calculated
Password strength comes down to how many unique passwords are possible — the larger this number, the harder brute-force guessing becomes. When characters can repeat (the default for real passwords), every position has n choices independently, so the count is n raised to the power of the password length r: n^r. If each character must appear at most once, you multiply n × (n−1) × … × (n−r+1), the falling-factorial (also called a permutation without replacement).
Entropy converts that count to bits: log₂(combinations). Each extra bit doubles the search space. Security guidelines generally recommend at least 60–80 bits of entropy for a strong password. At 26 lowercase letters and 8 characters you get only about 38 bits; expanding to all 95 printable ASCII characters raises it to about 53 bits; a 12-character mixed-case alphanumeric+symbol password tops 78 bits.
The crack-time estimate divides the combination count by 1 billion guesses per second — a typical offline attack rate on a modern GPU. The real rate depends on the hashing algorithm used: bcrypt or Argon2 slow attacks by orders of magnitude, while an unsalted MD5 can be attacked at trillions per second. Use the estimate as a relative guide, not an absolute guarantee.
Frequently asked questions
Entropy (in bits) measures unpredictability. Each extra bit doubles the number of guesses an attacker must try on average. A password with 60 bits of entropy requires about 2^59 ≈ 576 quadrillion guesses to crack — far beyond a casual attack.
Doubling the character set size (e.g., adding uppercase to lowercase) adds log₂(2) = 1 bit of entropy per character. Adding one more character to the length adds log₂(n) bits. Length has a bigger impact per unit of effort.
It assumes 1 billion guesses per second, typical for an offline GPU attack against fast hash functions. Against slow hashes (bcrypt, Argon2) the real rate is millions of times slower; against no hash it can be trillions per second. Use the figure for comparisons, not hard predictions.
Also known as
TG we-Calculate Editorial Team. (2026). Password Combination Calculator — Password Strength & Entropy [Online calculator]. TG we-Calculate. https://we-calculate.com/calculator/password-combination-calculator
TG we-Calculate Editorial Team. "Password Combination Calculator — Password Strength & Entropy." TG we-Calculate. 2026. https://we-calculate.com/calculator/password-combination-calculator.
TG we-Calculate Editorial Team, "Password Combination Calculator — Password Strength & Entropy," TG we-Calculate, 2026. [Online]. Available: https://we-calculate.com/calculator/password-combination-calculator
@misc{wecalculate_password_combination_calculator, title = {Password Combination Calculator — Password Strength & Entropy}, author = {{TG we-Calculate Editorial Team}}, howpublished = {\url{https://we-calculate.com/calculator/password-combination-calculator}}, year = {2026}, note = {TG we-Calculate} }
Did this calculator help you?