Password Combinations and Brute-Force Time Calculator

This tool estimates how many passwords are possible for a given character set and length, and how long a brute-force search would need to find one.

Here $c$ is the number of characters available, $L$ the length and $N$ the total combinations. With $v$ attempts per second, $t$ is the average time to a hit. On average half the space is searched before the password turns up, hence the division by two.

Length beats variety

The total grows as a power of the length. Widening the character set only enlarges the base, while adding a single character multiplies the whole total by $c$.

An alphanumeric password of 8 characters, drawn from 62, gives $2.18 \times 10^{14}$ combinations; at 12 characters it gives $3.23 \times 10^{21}$. Four more characters multiply the space by about 14.8 million. Adding symbols to reach 95 characters but staying at 8 gives only $6.63 \times 10^{15}$, nowhere near the 12-character alphanumeric.

Worked example

With 62 characters, a length of 12 and ten billion attempts per second, there are $3.23 \times 10^{21}$ combinations and an average search of roughly 5112 years.

Points to watch

All of this assumes a genuinely random string. A dictionary word, or a word with its letters swapped for lookalike symbols, falls far sooner, because an attacker runs the dictionary before resorting to brute force.

A reused password fails regardless of its length. Once it has leaked anywhere, it is found on the first attempt.