technology
did you know one random character can multiply the possibilities?
length grows a search space by multiplication, not addition.
×456,976
possibilities from four extra random letters
each letter is independent and uniformly chosen from a 26-letter alphabet.
- 26 choices
- 4 extra positions
- 26 × 26 × 26 × 26
the idea
if each character is chosen independently and uniformly from 26 letters, adding one character multiplies the possible strings by 26. four more characters multiply the total by 456,976.
how it works
eight uniformly random lowercase letters have 26⁸ possibilities. twelve have 26¹². the ratio is 26⁴, nearly half a million. this compares two ideal random generators, not two human-chosen words.
go deeper
why are combinations so explosive?
if each character is chosen independently and uniformly from 26 letters, adding one character multiplies the possible strings by 26. four more characters multiply the total by 456,976.
each existing string can have any of 26 letters appended to it. every extra position branches into 26 possibilities. the total is 26 multiplied by itself once for every position.
count possibilities, then question the assumptions
eight uniformly random lowercase letters have 26⁸ possibilities. twelve have 26¹². the ratio is 26⁴, nearly half a million. this compares two ideal random generators, not two human-chosen words.
a predictable pattern can occupy only a tiny corner of that theoretical space. adding a familiar suffix does not automatically provide the same uncertainty as independent random characters.
what do bits of entropy measure?
for equally likely strings, entropy is the base-two logarithm of the number of possibilities. each random letter from 26 choices contributes about 4.7 bits.
possibilities = 26ⁿ; entropy = n × log₂(26); 26⁴ = 456,976
does this predict a cracking time?
- not by itself. guessing speed depends on the attack, storage method, rate limits, and other protections.
- the calculation describes randomness under explicit assumptions. apparent complexity or character count alone does not establish a password's actual unpredictability.
sources & further reading
concepts: entropy · exponential growth · search spaces
2 minute read