Password combination calculator
Twenty-six lowercase letters and 8 characters give 208,827,064,576 possible passwords. Enter how many symbols each position can use and how long the password is, and get the exact count, never rounded. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Charset size
- 26
- Length
- 8
- Combination count
- 208827064576
A password combination calculator answers the counting question every password policy eventually asks: given a character set of size n and a password of length L, how many distinct strings can be formed? The answer is n to the power L, because each position independently chooses one of n symbols and order matters. Ten digits and four positions yield ten thousand PINs; twenty-six lowercase letters and eight positions yield more than two hundred billion passwords. This capability takes those two positive integers, evaluates the exact power with BigInt arithmetic, and returns the combination count as a decimal string so values beyond JavaScript safe integers stay exact. It rejects a length that is not a positive integer instead of inventing a keyspace.
What n to the power L means for a password keyspace
A password is an ordered string. If each character is drawn independently from an alphabet of n symbols, the first position has n choices, the second also has n choices, and so on for L positions. The product of those independent choices is n multiplied by itself L times: n to the power L.
That quantity is the password combination count, also called the keyspace. It is not a binomial coefficient. Combinations of the form n choose r count unordered subsets and shrink when order is ignored; passwords keep order, allow repetition, and grow exponentially with length.
Concrete landmarks help: a four-digit numeric PIN uses n equals ten and L equals four, so ten thousand combinations; eight lowercase English letters use n equals twenty-six and L equals eight, so two hundred eight billion eight hundred twenty-seven million sixty-four thousand five hundred seventy-six strings; eight mixed upper, lower, and digit characters use n equals sixty-two and already sit well beyond a trillion. Adding one more character multiplies the entire keyspace by n, which is why length dominates charset growth once n is fixed.
Who needs the number of possible passwords
Security and identity teams use a password combination calculator when writing policy: they compare a six-digit OTP space against an eight-character alphanumeric rule and see the exponential gap before they publish the requirement. Product managers and UX writers need the same number in plain language so a sign-up page can say how large the space is without a security engineer on every copy review. Teachers of discrete math and introductory cryptography assign n and L and check student powers against a deterministic oracle that never rounds.
Failed validation does not consume balance. Keep this page for keyspace counting; send a concrete candidate password to a strength checker, and send n choose r problems to a combinations calculator. Those neighbouring tools share some arithmetic flavour and none of this search intent.
What you can do with it
Password policy and OTP keyspace reviews
Compare n^L for digit PINs, alphanumeric rules, and printable-ASCII policies before you publish a minimum length.
Classroom powers and discrete-math checks
Give students a charset size and a length and verify their hand-computed keyspace against an exact decimal string.
Product copy and sign-up rule explainers
Turn a required alphabet and length into the number of possible passwords a help article or onboarding screen can quote.
FAQ
How is the number of possible passwords calculated?
Each of the L positions independently chooses one of n symbols, so the combination count is n^L.
What happens if the length is not a positive integer?
Zero, negative, fractional, missing, and non-numeric lengths are rejected and are not billed.
Is this the same as a password strength checker?
No. This tool counts the keyspace from charset size and length. It does not inspect a concrete password, estimate entropy of a sample, or generate one.
How many 4-digit PINs are possible?
Ten thousand. Each of the 4 positions can hold any of the 10 digits, so the count is 10 multiplied by itself 4 times, which is why short numeric codes are so limited.
What character set size should I enter?
Count the symbols allowed in each position: 10 for digits only, 26 for one letter case, 62 for upper and lower case with digits, and 95 for every printable basic character.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/stat/password-combination \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"charset_size":26,"length":8}'const res = await fetch("https://api.kit.forhosting.com/stat/password-combination", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"charset_size": 26,
"length": 8
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/stat/password-combination",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"charset_size": 26,
"length": 8
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/stat/password-combination", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"charset_size":26,"length":8}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"charset_size":26,"length":8}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/stat/password-combination", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"charset_size": 26,
"length": 8
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "stat.password_combination",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
max_charset_size | 1000000 |
max_length | 256 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
What n to the power L means for a password keyspace
This endpoint evaluates that power with binary exponentiation on BigInt values and returns the exact decimal string. It does not score a particular password, estimate crack time, or sample random strings: those are different search intents. It only answers how many passwords exist under the independent-position model you stated. When n or L is outside the published positive-integer limits the request fails rather than approximating or wrapping.
Input contract, response shape, and error behaviour
The count is a string on purpose: sixty-two to the tenth already exceeds the JavaScript safe-integer limit, and longer mixed-alphabet passwords would silently lose low-order digits if forced into a Number. Failed validation is not billed. Numeric strings of digits are accepted; strings with units, commas, or scientific notation are rejected. Prefer this contract when you already know the alphabet size and the required length and want the exact keyspace, not a strength grade of one sample password. POST a JSON body with two required positive integers. charset_size (aliases charset, alphabet_size, n) is how many distinct symbols each position may use and must be an integer from one through one million. Typical policy values are ten for digits, twenty-six for one letter case, thirty-six for letters plus digits, sixty-two for mixed alphanumeric, ninety-five for printable ASCII, and two hundred fifty-six for a full byte. length (aliases password_length, l) is the number of characters and must be a positive integer from one through two hundred fifty-six. A length that is missing, zero, negative, fractional, infinite, or non-numeric fails with invalid_input naming the field; the same rule applies to charset_size. On success the body echoes charset_size and length as numbers, combination_count as a decimal string of the exact power n to the L, and formula as the identity n^L so clients can display the model without hard-coding it. Pricing is a fixed $0.002 per successful call with unit item.
Where a password-combination API earns its keep
Exam generators need a hard failure when length is not a positive integer, instead of a success payload of one that a buggy grader might treat as an empty-password edge case.
Technical questions
Why is combination_count returned as a string?
Many realistic keyspaces exceed JavaScript safe integers. A decimal string keeps every digit of n^L for every supported charset_size and length.
What does the password combination calculator cost?
The browser tool is free. API requests use prepaid KIT balance at $0.002 per successful call; invalid input is not billed.