The formula
combinations = alphabet raised to the length
Where it comes from
It is pure combinatorics: with an alphabet of 94 characters and 12 positions there are 94 to the power of 12 possible combinations, and on average you hit halfway through. The measure that sums all that up is entropy in bits, the base-two logarithm of the number of combinations: every bit of entropy doubles the attacker’s work. Twelve characters from the whole keyboard give 78.7 bits.
How to work it out by hand
- Count how many different characters could appear
- Raise that to the length of the password
- Divide by two: on average you hit halfway
- Divide by the attacker’s attempts per second
What is worth knowing
The practical conclusion is one and it runs against intuition: **length beats complexity**. Every extra character multiplies the time by the whole alphabet, whereas adding odd symbols multiplies it once. Twelve lower-case letters give more entropy than eight characters from the whole keyboard, and are far easier to remember and to type: hence the recommendation to use passphrases. But none of this holds if the password is not random. Swapping letters for numbers — "p4ssw0rd" — adds almost nothing, because attack dictionaries have had those substitutions built in for twenty years. And a password reused on two sites is worth whatever the weaker of the two is worth.