Password Brute Force

Rules

Minimum length

Maximum length

0 = no maximum.

Min. lowercase

Min. uppercase

Min. numbers

Min. special

Disallowed characters

Each character listed is banned.
No input means no policy.

Attack model

Attacker alphabet

Start length attacker knows it

Off: starts at length 1.
On: starts at the minimum length.

Time per attempt

Preset

—

Sequential search, ordered by length then by ASCII value.

Attempts to reach

—

Total keyspace searched

—

Position in keyspace

—

Alphabet size

—

Keyspace entropy

—

Worst case (whole keyspace)

—

Model: The password is treated as a number in base N, where N is the attacker alphabet size. Candidates are tried in strict order of every candidate of length 1, then every candidate of length 2, and so on. Each length is enumerated in ASCII order. No dictionaries, leaked-password lists, or heuristics are used, so:

The result is the exact position of your password in that enumeration, not an average or an accurate estimate in the context of real-world password cracking.
A real attacker using common-password lists would very likely be faster. Treat this as an upper bound for a naive attacker, not a promise. If your password is 123456, don't count on the calculation to be accurate. It's likely to be tried within the first few attempts, along with the other 10k most common passwords.
Composition rules (min. uppercase, etc.) are checked but never used to skip candidates. Only the minimum length can shorten the search, and only when that box is ticked.

Password Brute Force Calculator