all lessons

technology

did you know one random character can multiply the possibilities?

length grows a search space by multiplication, not addition.

the idea at a glance

×456,976

possibilities from four extra random letters

each letter is independent and uniformly chosen from a 26-letter alphabet.

  1. 26 choices
  2. 4 extra positions
  3. 26 × 26 × 26 × 26

the idea

if each character is chosen independently and uniformly from 26 letters, adding one character multiplies the possible strings by 26. four more characters multiply the total by 456,976.

how it works

eight uniformly random lowercase letters have 26⁸ possibilities. twelve have 26¹². the ratio is 26⁴, nearly half a million. this compares two ideal random generators, not two human-chosen words.

go deeper

why are combinations so explosive?

if each character is chosen independently and uniformly from 26 letters, adding one character multiplies the possible strings by 26. four more characters multiply the total by 456,976.

each existing string can have any of 26 letters appended to it. every extra position branches into 26 possibilities. the total is 26 multiplied by itself once for every position.

count possibilities, then question the assumptions

eight uniformly random lowercase letters have 26⁸ possibilities. twelve have 26¹². the ratio is 26⁴, nearly half a million. this compares two ideal random generators, not two human-chosen words.

a predictable pattern can occupy only a tiny corner of that theoretical space. adding a familiar suffix does not automatically provide the same uncertainty as independent random characters.

what do bits of entropy measure?

for equally likely strings, entropy is the base-two logarithm of the number of possibilities. each random letter from 26 choices contributes about 4.7 bits.

possibilities = 26ⁿ; entropy = n × log₂(26); 26⁴ = 456,976

does this predict a cracking time?
  • not by itself. guessing speed depends on the attack, storage method, rate limits, and other protections.
  • the calculation describes randomness under explicit assumptions. apparent complexity or character count alone does not establish a password's actual unpredictability.
sources & further reading

concepts: entropy · exponential growth · search spaces

2 minute read