How Long Would It Take to Guess Your Password?

A password is a string of choices, each character picked from an alphabet. The product rule multiplies the choices, so every extra character multiplies an attacker's work by the size of the alphabet. That's why length beats cleverness.

How it works

The product rule

In one sentence

Product rule: a procedure of $L$ independent stages with $k$ choices each has $k^L$ outcomes. For a uniformly random password among $N$ , a search in random order needs $(N + 1)/2 \approx N/2$ guesses on average.

General formula

{\htmlData{sym=0}{N}} = {\htmlData{sym=1}{k}}^{\htmlData{sym=2}{L}}, \qquad {\htmlData{sym=3}{t}} = \frac{\htmlData{sym=0}{{N}}}{2{\htmlData{sym=4}{g}}}

Each character is another stage of choices, so the possibilities multiply: exponential growth in the length.

What the symbols mean

$N$
Possible passwords
How many different passwords of this length and alphabet exist.
$k$
Alphabet size
How many symbols each character can be.
$L$
Length
How many characters the password has.
$t$
Average time to guess
Seconds an attacker needs, on average, to hit your password.
$g$
Guess rate
Guesses per second the attacker can make.

Each character is chosen from $k$ symbols, independently, so by the product rule there are $k \cdot k \cdots k = k^L$ possible passwords of length $L$ .
An attacker trying them in random order finds yours after about $N/2$ guesses on average; at $g$ guesses per second that takes $t = N/(2g)$ seconds.
Adding one character multiplies N by k, at least 10; adding symbol types only nudges k up. A 16-character lowercase password beats an 8-character one full of symbols.
This assumes a truly random password. Real attackers try dictionary words and common patterns first, which is why 'P@ssw0rd!' falls in seconds whatever the formula says.

Learn the math

The Sum and Product RulesDiscrete · Lesson 14, Counting Sequences, Sums and Closed FormsDiscrete · Lesson 20, Sequences and Recurrences Binary and HexadecimalDiscrete · Lesson 29, The Math Inside Computers