# How can i calculate the number of possible passwords?

I have found a flaw in a site where the password reset feature resets passwords in the following format

UpperCaseLetter-Number-LowerCaseLetter-Number-LowerCaseLetter-Number-UpperCaseLetter

Eg: A0b1c2d

I'm trying to determine how many possible password combinations there are for a system like this (where i can predict the 'password format' vs something random that uses the entire Upper/Lower-Alpha-Numeric Keyspace.

I'm not a cryptographer but this seems like a significant weakness to me. I'd like some data to back that assumption up :) Cheers

-
I think it turns out being 456,976,000 passwords vs 3,521,614,606,208 (for 7 chars)? – NULLZ Mar 26 '13 at 1:14

To get the number of permutations, multiply the number of possibilities at each position:

26x10x26x10x26x10x26 = 456,976,000

-
Which, just to clarify, is a pitifully small pool of potential passwords. – Stephen Touset Mar 26 '13 at 2:19
Yes... Wasn't trying to convey that this number is sufficient... Only to show how to derive the answer. – BrianAdkins Mar 26 '13 at 2:29
No worries. Just thought it warranted explicit mention. – Stephen Touset Mar 26 '13 at 2:30

I would like to mention on top of the other answer(s) in regards to the weakness of this particular system, a password reset feature is only for temporary passwords. The password could be reset because a user forgot it or has been locked out of the system.

Since the user requests that the password reset, with some other form of validation of account ownership like email address, the password should only be active for around 5 minutes or less. If the password reset is implemented securely, it may lock the account after 10 attempts to deter brute force at the time of password reset. However, this attack is probably unlikely to happen with the small time constraint.

If an attacker gets ahold of the encrypted database passwords, then they may be able to bruteforce the table of temporary passwords to try and log in before the user is able to. In this case, having a small password is a weakness but they probably have other weaknesses as well.

-