GREENCALC JOURNAL

A Password Policy Count Is Not Automatically Password Entropy

A valid-string count describes a policy space If a policy allows 94 distinct characters at each of eight positions, with repetition and no additional.

A blank password-policy card beside an unmarked padlock and colored tiles.
A Password Policy Count Is Not Automatically Password Entropy — conceptual editorial illustration.

A blank password-policy card beside an unmarked padlock and colored tiles. Original AI-generated artwork produced for GreenCalc; not a measured diagram or empirical data display.

Image use and attribution

A valid-string count describes a policy space

If a policy allows 94 distinct characters at each of eight positions, with repetition and no additional restrictions, it permits 94⁸ = 6,095,689,385,410,816 strings. The logarithm base two of that count is about 52.44. That number describes the size of a mathematical space; it is not automatically the entropy of passwords people actually choose.

Uniform selection is the missing condition

If every valid string is selected with equal probability, the uniform model has entropy log₂(count). Human choices can be concentrated on names, patterns or reused phrases, making the distribution far from uniform. A policy that permits many strings does not establish that a particular password was sampled randomly from them. Counting permitted strings and evaluating a real credential are separate tasks.

Keep character groups disjoint

When entering group sizes, count each allowed character once. A custom group that overlaps the uppercase or digit group cannot simply be added to both. Required-group rules further change the count by excluding strings that omit a category. The inclusion–exclusion guide explains that adjustment using a small example.

Use the calculator without disclosing a credential

The Password Combination Calculator requests group sizes and lengths, never a real password. It does not estimate account compromise time, inspect breached-password lists or generate a secret. Its log₂ output is explicitly a count-based quantity whose entropy interpretation depends on selection probabilities. For a generic ordered string count without policy-group requirements, use the Permutation Calculator in repetition mode. Do not infer security from a large combinatorial number while ignoring how a credential was chosen and how an authentication system protects it.

Check the model behind your result

Use the Password Combination Calculator for the supported calculation and review its stated assumptions before interpreting the output. Find related tools in the Statistics category, or browse the GreenCalc homepage for other calculation topics.

By GreenCalc Editorial Team · Updated 2026-10-26

Sources

How was this calculator?

Your email stays private. Comments are published after moderation.