Password Combination Calculator

Calculating password combinations for a given set of rules can help you understand the strength of a password against brute-force attacks. This tool can help you with this task — it uses combinatorics to find how many possible passwords you can create with a given set of characters. Keep reading this article to learn:

• Why do we need long passwords (and why are they getting longer and more complex)?
• How many password combinations are possible with a given set of characters?
• How to use our number of password combinations calculator?

And much more!

Passwords are a fundamental aspect of the information age: in our interconnected world, where more and more data is stored online, the protection and uniqueness of one's identity and private data is increasingly important. Passwords are a way of protecting against unwanted intrusions since early history: asking for a word to confirm one's trusted identity is as old as secrets, and the presence of passwords even in many kids' games is a confirmation of how rooted this system is in our cultures.

With computers, passwords became a much more concrete concept — and with them, attempts to illicitly bypass them and access what they protect. In the past decades, passwords and hackers have been engaged in a restless arms race that caused both to get better at their own game.

As a string of only letters, numbers, and symbols, a password is a well-defined and discrete object potentially vulnerable to brute-force attack. A brute-force attack is a mindless attempt to crack a password by pure guessing. With short passwords, this is relatively easy: a PIN code with four digits has exactly 10,000 combinations. An agent that can try a combination every second would take less than 3 hours to find the right one (and just to worry you a bit, the worst computer algorithms that can perform this task can try 10,000 combinations per second!). Clearly, we need more complexity in our passwords.

The computational power of processors keeps growing, but passwords can arbitrarily become so complex that guessing it by brute force would take time in the order of billions of years — while hackers can be patient, we're pretty sure they can't wait this long! Novel techniques involve attempting to crack more than one account at a time, using educated guesses rather than purely random ones, hoping that 12345 and password (or similar common passwords) are used by multiple accounts: since complexity clashes with our brains, this type of attacks can be surprisingly successful. We are not made to remember 16-characters long strings of randomly chosen letters, numbers, and symbols, and we tend to choose easy-to-guess non-random combinations, or we repeat complex passwords over many accounts.

Let's learn how to calculate the number of passwords before discovering more about their complexity and how to choose the best password!

To calculate the number of password combinations possible for a given set of parameters, we need to dive into the field of combinatorics. This branch of math deals with various ways to combine different or identical objects. You've met the characteristic words of combinatorics many times, even in your daily experience: combinations, permutations, partitions...

When talking about passwords, we need to consider the permutations. Permutations are groups of a certain number of elements extracted from a larger set. Crucially, the ordering of the elements does matter: just as abc and cba are distinct passwords, so $a,b,c$ and $c,b,a$ are distinct permutations.

In mathematical terms, we would indicate permutations with the following notation:

where:

• $n$ — The total number of items to choose from; and
• $k$ — The length of the permutation to create.

Computing permutations is relatively simple, and we can give you a neat interpretation. Let's try to answer this question: how many permutations of $3$ elements can we extract from a set of $10$ elements?

1. Take an element from the bigger set. You have $10$ options; you choose one, and $9$ items are left over.
2. Take a second element from the remaining $9$ options.
3. Take a third element from the remaining $8$ options.

After Step 1, you'd end up with any of ten possible items. After Step 2, you'd have one pair from among $9 \cdot 10 = 90$ possible pairs. And after Step 3, you'd have a distinct three-item set from among $10 \cdot 9 \cdot 8 = 720$ possible outcomes.

If this multiplication of consecutive numbers rung a bell, it's because the formula for the number of permutations uses the factorial: $n! = 1 \cdot 2 \cdot 3 \cdot ... \cdot n$. It's not hard to imagine that the result of the example above comes from the division of two factorials:

The generic formula for permutation is, then:

Permutations with repetition

What would happen if, after each draw, you would put the item back in the set? The answer is repetition. Even though it may look harder than before, calculating permutations with repetition is, once again, pretty straightforward. Take the examples of before, but put back the item every time:

1. At the first step, you'd have $10$ options.
2. At the second step, you'd have once again $10$ options (because the option selected in Step 1 wasn't removed).
3. At the third step — you guessed it, you have $10$ possibilities.

If you follow the same reasoning as before, you will find out that the number of permutations is $\small 10 \cdot 10 \cdot 10 = 10^3 = 1000$. The mathematical formula for the number of permutations with repetition is:

You have the basics tool; let's learn how to calculate the available password combinations. This effort will involve adding a step to our reasoning.

To calculate how many possible combinations of your password you can find, it's best to start by defining the possible characters. Using the Latin alphabet, we can identify:

• $26$ lowercase letters; and
• $26$ uppercase letters.

To these, we can add:

• $10$ digits (from $0$ to $9$); and
• Some or all of $32$ symbols (like (, #, &, and so on).

The permutation of a password always allows repetition: we will only deal with exponents! Now that we understand which formula we will use, let's define the elements that will appear there:

• $n$ — The number of possible characters; and
• $k$ — The length of the password.

The number $n$ is nothing but the sum of the numbers of the available characters. If all characters listed above are used, we would have:

This is not a small number. In the next section, you will see how quickly the number of permutations can grow. Before this, we need to calculate the password permutations when a condition of the type at least one uppercase character/number/symbol sets in. We know it's frustrating when this happens, but trust us, compared to a simple password made of only lowercase letters, this improves the safety of your accounts many times. How do we write this condition in numbers?

We take all the possible permutations, with repetitions that contain the desired type of character, and then we subtract the permutations that don't respect the condition. To do so, we use the inclusion-exclusion principle, a tool that stems from set theory. As you can imagine, for a higher number of conditions (e.g., at least one number and one uppercase letter), the groups of incorrect passwords increase in number.

This will be much easier to understand with a couple of examples. Let's say you are tasked with creating a $10$ character-long password with uppercase and lowercase letters. How many permutations with repetition can we have? The answer is $(26+26)^{10}$. If we need to have at least one uppercase letter (and, of course, at least one lowercase letter), we need to subtract from these permutations the ones that contain only lowercase letters and those with only uppercase letters. How many of those are there? Simple: $26^{10}$ in both cases. The number of $10$ letter-long passwords and at least one uppercase letter and at least one lowercase letter is then:

You can expand this reasoning for any combination of these requirements. Let's see how in our worked example.

Let's say you need to create a password with the following requirements:

• At least one lowercase letter (the default condition).
• At least one uppercase letter.
• At least one number.
• Any of eight symbols are also allowed (but not required).

To calculate the password permutations, we need first to define how many characters we can input. Let's see. There are:

• $52$ letters ($n_\mathrm{u} = 26$ uppercase letters and $n_\mathrm{l}=26$ lowercase letters);
• $n_\mathrm{n}=10$ digits; and
• $n_\mathrm{s}=8$ symbols.

The total number is then:

To calculate the password combinations, we start by considering all possible passwords we can build with these characters. Let's do this for a five-letter password. We know it's not the safest one, but it will do it!

It's time to consider the passwords not allowed by our rules. There are different types of these:

• Passwords with three types of characters that don't contain lowercase letters, uppercase letters, and numbers.
• Passwords with two types of characters (they don't respect the conditions by default).
• Passwords with only a type of character.

In the calculations and the picture below, we will borrow a bit of set theory notation. Let's use the letter $\rm{L}$ for lowercase letters. Seeing $\rm{L}$ in the name of a set means that the passwords in that set contains lowercase letters. The letter $\rm U$ identifies uppercase letters, $\rm N$ numbers, and $\rm S$ symbols.

The number of passwords contained in a set is called cardinality. We mark it with the "absolute value" notation: $\rm{UN}$ is the set of passwords containing exclusively uppercase letters and numbers, and it contains $|\rm UN |$ passwords.

To find the number of passwords that fulfill our criteria, we need to identify the corresponding members of the diagram above. In our case, we will need to isolate the members containing only uppercase and lowercase letters and numbers and the members containing uppercase letters, lowercase letters, symbols, and numbers. That is to say, we need to find the cardinalities of the sets $\rm LUN$ and $\rm LUNS$: this is not a straightforward task!

To find the cardinality of $\rm LUN$, we temporarily restrict our problem to a three-type password. $\rm LUN$, in this case, is the intersection of all three sets. We subtract from all the possible passwords in:

• The set containing only one type ($\rm L$, $\rm U$, and $\rm N$); and
• The two-sets intersections ($\rm LU$, $\rm LN$, and $\rm UN$).

Finally, for single-type passwords, we have:

• $\rm{L}$ with $|\rm{L}|=26^5=11,881,376$.
• $\rm{U}$ with $|\rm{U}|=26^5 = 11,881,376$.
• $\rm{N}$ with $|\rm{N}|=10^5 = 100,000$.

To find the cardinalities of the two-sets intersection, we use the following formulas:

• $|\mathrm{LU}| = (n_\mathrm{l}+n_\mathrm{u})^5 -n_\mathrm{l}^5-n_\mathrm{u}^5$, that gives us $|\rm{LU}| = 356,441,280$.

• $|\mathrm{LN}| =(n_\mathrm{l}+n_\mathrm{n})^5 -n_\mathrm{l}^5-n_\mathrm{n}^5$, that gives us $|\rm{LN}| =48,484,800$.

• $|\mathrm{UN}| =(n_\mathrm{u}+n_\mathrm{n})^5 -n_\mathrm{u}^5-n_\mathrm{n}^5$, that gives us $|\rm{UN}| =48,484,800$.

Join them in the following formula to find their intersection:

To find the cardinality of $\rm LUNS$ (the four-type intersection that also contains symbols), we need to expand the previous formula, including all possible contributions from the remaining two-set intersections (we find three more: $\rm LS$, $\rm US$ and $\rm NS$), the single set with only symbols allowed in the passwords ($\rm S$), and the four possible three-set intersections: we met $\rm LUN$ before, now we introduce $\rm LUS$, $\rm LNS$, and $\rm UNS$.

The final formula for the cardinality of $\rm LUNS$ is:

Now we must sum the cardinalities of the set we found satisfying our conditions. You will find that the number of passwords with numbers, eight symbols, uppercase letters, and lowercase letters and at least one lowercase letter, one uppercase letter, and a number is:

More than half a billion passwords: as you can see, it's not an excessively high number. However, the length is only five characters: with eight characters, the number of allowed passwords would be $384,004,643,742,720$. This is one of the instances where size does matter!

What if we want to make our passwords more secure? Let's say increasing the number of required characters to eight. We can skip the math and use Omni's password combination calculator to find how many possible combinations of passwords you can see in this case. How do you do this? Follow these simple steps to learn how to use our password combination calculator.

1. Choose the number of character in your password.

2. Select if your password is case sensitive or not.

   • Decide if you have to insert at least one uppercase character.

3. Choose if your password contains numbers.

   • Decide if you want to make the presence of at least one number mandatory.

4. Decide if you can use symbols. In this case, you can use all of them (there are $32$), include only some of them, exclude only some of them, or exclude them altogether.

   • Choose if the symbols must appear in your password.

5. You can forget how to calculate the available password combination — we'll print the result instantly.

After choosing the right length of your password, head to our password entropy calculator to calculate how safe it can be!

To calculate how many possible combinations of passwords are for a given set of characters, you must use the mathematics of permutations:

1. Count the number of allowed characters.
2. Calculate the number of the allowed characters to the power of the length of the password.

The result is the number of passwords that allow repetition. The formulas get more complex when we introduce conditions: in that case, you need to subtract the number of passwords that don't respect them.

A password with a length of 16 characters is generally secure. However, using regular patterns, complete words, or fewer special characters reduce the complexity and simplifies brute-force attacks. Using uppercase and lowercase letters, numbers, and eight symbols, with at least one character from each category, gives you 258,931,250,661,140,200,000,000,000,000 possible password combinations. Guessing a million passwords per second would take almost ten million years.

The number of 12-character passwords with a combination of uppercase and lowercase letters is 390,686,148,572,926,840,000. To find this result:

1. Calculate the number of possible characters. In this case, since there are 26 letters, we have 26 + 26 = 52 characters.

2. Compute the 12^th power of the number of characters:

   52¹² = 390,877,006,486,250,192,896

3. If you need to include at least one uppercase and one lowercase letter, subtract the combinations of only lowercase and only uppercase letters:

   52¹² − 26¹² − 26¹² = 390,686,148,572,926,840,000

To remember your password, use the following tricks:

• Use a memorable sentence: think of, for example, "correct horse battery staple".

• Pick only the initials of a longer sentence.

• Remove the vowels or substitute them with numbers, but don't use leetspeak: it's a common substitution.

• Combine a word and a number, alternating letters, and digits.

• Use your imagination, and use familiar numbers or words in unexpected ways: the date of birth of your pet, in reverse, with its name, uppercase, in between.

From a technical point of view, four digits PINs are not secure. With a total number of combinations of 10,000, even with repetition, a brute force attack would take mere seconds to retrieve your PIN.

However, a system that prevents multiple attempts or temporary pins makes even a short combination of numbers safe enough. Just don't use them as the password of your bank account!