Password Strength by the Numbers: Permutations, Length, and Guessing Time
October 21, 2026
The number of possible passwords is (character set size)^(length). An 8-character password using only lowercase letters has 26^8 = 208,827,064,576 possibilities, about 209 billion. An attacker testing 10 billion guesses per second, which is plausible for offline attacks against fast hashes, could exhaust that space in about 21 seconds. Adding length is far more effective than adding symbols.
Skip the math and get your answer instantly:
Open the Permutation & Combination Calculator →The Combinations
Each additional character multiplies the possibilities by the size of the character set. A 94-character set (upper and lower case, digits, symbols) gives 94^8 = 6.1 quadrillion for 8 characters and 94^12 = 4.8 × 10²³ for 12 characters.
| Password | Possibilities | Time at 10 billion guesses/s (worst case) |
|---|---|---|
| 8 lowercase letters | 2.1 × 10¹¹ | 21 seconds |
| 8 characters, 94 symbols | 6.1 × 10¹⁵ | about 7 days |
| 12 lowercase letters | 9.5 × 10¹⁶ | about 110 days |
| 12 characters, 94 symbols | 4.8 × 10²³ | about 1.5 million years |
Randomness Is the Catch
These numbers assume every character is chosen randomly. People do not choose randomly: they use words, names, dates, and predictable substitutions such as '@' for 'a'. Attackers try those first, so a human-chosen 12-character password can be much weaker than the table suggests.
A passphrase of four or five randomly selected words from a large word list gives strong protection and is easier to remember. With a 7,776-word list, five words yield 7,776^5 ≈ 2.8 × 10¹⁹ combinations.
Practical Advice
Use a password manager to generate a long, random, unique password for each account, and enable two-factor authentication. Reusing a password means one breach exposes every account that shares it.
Websites that store passwords well use slow hashing functions, which cuts attackers' guess rates dramatically, but you cannot see how a site stores yours. Plan for the worst case.
Frequently Asked Questions
How many possible passwords are there with 8 characters?
Depends on the character set: 26^8 ≈ 2.1 × 10¹¹ for lowercase letters only, and 94^8 ≈ 6.1 × 10¹⁵ using all keyboard characters.
Is length or complexity more important?
Length. Each extra character multiplies the possibilities, and requirements for symbols are often predictable.
What is a good password length?
At least 12 to 16 characters for random passwords, and longer for passphrases.
Are passphrases secure?
Yes, if the words are chosen randomly. Famous phrases and song lyrics are not secure.