Passwords Are Ordered Counts

Passwords are a useful contrast, not a pure combination. In a password, order matters and characters can repeat, so the count uses the multiplication rule: choices per position raised to the number of positions. An 8-character password using roughly 95 possible characters has about 95^8 possibilities. That is not C(n,k); it is an ordered sequence count.

An 8-character password using lowercase, uppercase, digits, and symbols draws from roughly 95 characters per position: 95^8 is about 6.6 quadrillion possibilities. Lengthening to 12 characters reaches 95^12, hundreds of sextillions of possibilities.

That huge jump is why length matters. Actual cracking time still depends on hashing method, rate limits, attacker hardware, password reuse, and whether the password was chosen randomly or follows a human pattern.