At One Place

How many possible passwords are there?

How many possible passwords are there?
6.6 quadrillion for eight characters — 540 sextillion for twelve
A four-digit PIN has 10,000 possibilities and studies of leaked PINs find that "1234" alone accounts for roughly 10% of real ones. Human choice, not the size of the space, is almost always what breaks a password.

With the 95 printable ASCII characters, an eight-character password has 95^8 = 6,634,204,312,890,625 possibilities. That sounds large and is not: a purpose-built cracking rig testing a fast hash at 100 billion guesses a second exhausts the entire space in under a day. Add four characters and 95^12 = 5.4 × 10^23 takes the same rig around 170,000 years. Length beats complexity by an enormous margin, which is why modern guidance dropped the mandatory-symbol rules and raised the minimum length instead.

How the figure is arrived at

c^n, where c is the character set size and n the length: each extra character multiplies the space by 95, while each extra symbol class multiplies it far less. Real attacks never search the space uniformly — they try leaked password lists, dictionary words with predictable substitutions, and keyboard patterns first, which is why an eight-character password chosen by a person is usually broken in minutes rather than a day.

Other numbers and possibilities counts

Common questions

How many possible passwords are there?
6.6 quadrillion for eight characters — 540 sextillion for twelve
How is that estimated?
c^n, where c is the character set size and n the length: each extra character multiplies the space by 95, while each extra symbol class multiplies it far less. Real attacks never search the space uniformly — they try leaked password lists, dictionary words with predictable substitutions, and keyboard patterns first, which is why an eight-character password chosen by a person is usually broken in minutes rather than a day.

Related pages

Sources

  1. Calculated on this page — At One Place

How these figures are compiled and checked