Free password keyspace calculator

Free password search space calculator

Use the password search space calculator to turn known password clues into an exact candidate count, then estimate average and worst-case search time.

Exact keyspace

Describe the password pattern you want to test

Use Hashcat tokens: ?l lowercase, ?u uppercase, ?d digits, ?s symbols and ?a all printable ASCII. Literal characters are known positions.

Password maskExample: Summer?d?d?d?d tests a known word followed by four digits.Measured speed, candidates per secondUse a Hashcat benchmark for the detected mode. The default is only an example rate.

Continue the workflow

Continue locally or expand the search with GPU cloud

The desktop app handles free local checks. GPU cloud adds larger dictionaries, numeric masks and combinations, but cannot guarantee a match.

Download the desktop app Compare GPU cloud plans

Measure before you search

Turn password clues into an exact candidate count

A password combination calculator shows how much work a mask search actually contains. The password search space calculator keeps known letters fixed while every unknown token multiplies the search space by the size of its character set.

Enter a Hashcat-style mask and a measured candidates-per-second rate. The password search space calculator reports maximum attempts, average expected attempts, and average and worst-case time. The calculation is exact for the mask, but the speed must come from the same file encryption mode and hardware you plan to use.

Practical guide

How the password search space calculator estimates a recovery search

Mask language

Build a mask in the password search space calculator

Literal characters represent parts you already know. Tokens represent positions that must be tested. This password combination calculator reduces a broad brute-force search to the pattern that matches your real password clues.

Token or mask	Meaning	Candidates
?d	One digit from 0 to 9	10
?l / ?u	One lowercase or uppercase ASCII letter	26
?s	One supported ASCII symbol	33
?a	One printable ASCII character	95
Summer?d?d?d?d	Known word followed by four digits	10,000
?u?l?l?l?d?d?d?d	Uppercase, three lowercase letters and four digits	4,569,760,000

Calculation method

Maximum attempts and average attempts answer different questions

Worst-case attempts equal the full keyspace because the correct password could be the final candidate. Under a uniformly ordered exhaustive search, the average expected position is approximately half of the keyspace.

For example, eight unknown digits produce 100,000,000 combinations and about 50,000,000 average attempts. Adding uppercase and lowercase letters to every position increases the search dramatically because the character set is multiplied at each position.

Performance input

Use the password recovery time calculator with the exact hash mode

The password recovery time calculator needs a speed from the same encryption mode. A GPU can test a fast archive format much more quickly than a deliberately slow Office or PDF key derivation. Hardware alone is not enough to estimate time: the file version, encryption revision and Hashcat mode determine the work per candidate.

Run a benchmark for the detected mode and enter the reported candidates per second. Do not reuse a ZIP benchmark for Office 2013 or a PDF benchmark for 7-Zip.

Use mode 9400, 9500 or 9600 for the matching Office hash generation.
Use the PDF mode reported from the extracted revision.
Use the archive mode that matches PKZIP, WinZip, RAR or 7-Zip.
Treat displayed time as an estimate because thermal limits and workload settings can change real speed.

Dictionary searches

Dictionary and rule attacks do not equal character-set length

A dictionary search tests the number of words actually present in the list. Rule expansion then produces additional candidates from each word. Its size must be measured from the dictionary and rule output rather than calculated as character-set size raised to password length.

Use the mask calculator when you know a positional pattern such as a fixed name plus four unknown digits. Use the desktop common-password dictionary first when you only know that the password is likely to be familiar or reused.

Questions about this tool

Frequently asked questions

How does the password search space calculator handle an 8-digit password?

The password search space calculator counts eight unknown decimal digits as 10^8, or 100,000,000, possible combinations. A password combination calculator therefore reports about 50,000,000 attempts on average.

What does ?a mean in a Hashcat mask?

In the Hashcat mask calculator, ?a represents 95 printable ASCII characters. Each ?a position multiplies the search space by 95.

Why does the calculator ask for candidates per second?

A password recovery time calculator needs this rate because the same number of combinations can take very different times depending on the Office, PDF or archive encryption mode and the CPU or GPU running it.

Is average recovery time guaranteed?

No. Average time assumes the correct password is inside the mask and candidate order and is located near the midpoint. The correct password may be first, last, or absent from the search entirely.

Can I calculate a dictionary attack with this mask calculator?

Not from password length alone. Dictionary work equals the actual dictionary candidates plus any candidates generated by rules. That count should be measured from the selected lists and rules.

Does GPU cloud guarantee that the password will be found?

No. More GPU capacity can test a larger candidate range sooner and improve coverage, but it cannot find a password that is outside the selected dictionary, mask or rules.

Should fixed characters be included in the mask?

Yes. Type known characters literally. Only unknown positions should use tokens such as ?d, ?l or ?a, which can reduce the keyspace substantially.