A lock is a counting problem
Take a bicycle lock with three dials, each showing the digits 0 to 9. A setting is just a choice for the first dial, a choice for the second and a choice for the third. Each dial has 10 options, and the dials do not affect one another, so the number of settings is
10 × 10 × 10 = 1,000.
This is the multiplication principle at work: when a code is built from independent positions, multiply the number of options in each position. The same reasoning covers PINs, luggage locks, safes with number pads and passwords.
A small terminology point: everyday “combination locks” are really about ordered sequences, since 1-2-3 and 3-2-1 are different settings. In counting language that makes them permutations with repetition allowed, not combinations.
How length changes the count
Each extra position multiplies the total by the size of the character set. With digits only:
| Length | Possible codes | Calculation |
|---|---|---|
| 3 | 1,000 | 10³ |
| 4 | 10,000 | 10⁴ |
| 5 | 100,000 | 10⁵ |
| 6 | 1,000,000 | 10⁶ |
Going from 4 digits to 6 digits does not make the lock 50 percent larger; it makes it 100 times larger, because two extra positions each multiply by 10. This kind of steady multiplication is called exponential growth, and it is the single most important idea in this topic.
Simply knowing the count does not say how quickly a code could be found, because that depends on how fast guesses can be tried. As a plain illustration only, if someone could try one setting per second, then going through all 10,000 four-digit codes would take at most 10,000 seconds, a little under three hours. A million six-digit codes would take roughly 11.6 days at the same rate. Real devices differ widely: some allow rapid trying, and some limit attempts.
When digits cannot repeat
Some codes forbid repeated digits. For a four-digit code that uses distinct digits, the first position has 10 options, the second 9, the third 8 and the fourth 7:
10 × 9 × 8 × 7 = 5,040.
That is about half the 10,000 total for unrestricted codes. Restrictions often shrink the space more than people expect, which is one reason rules like “no repeated characters” are generally not helpful. The shrinking-options pattern is the same one used in permutations.
Letters, digits and symbols
Passwords use larger character sets, so each position contributes a bigger factor. Using only lowercase English letters, there are 26 options per position. Because 26 × 26 = 676, two letters give 676 combinations, and an eight-letter lowercase password has
26⁸ = 208,827,064,576
possibilities, about 2.1 × 10¹¹.
If upper-case letters, lower-case letters and digits are all allowed, the set has 26 + 26 + 10 = 62 characters. Then eight positions give
62⁸ = 218,340,105,584,896,
about 2.2 × 10¹⁴. Widening the character set from 26 to 62 multiplies the eight-character count by roughly a thousand. Adding characters to the length would have a larger effect: one extra character on the 62-character set multiplies the total by 62.
Both of these are counts of every possible string. They are the right numbers only if the string was chosen uniformly at random. Real people tend to choose predictable words, dates and patterns, so the practical set of likely passwords is much smaller than the full count. The counting tells you the ceiling, not what people actually do.
Order, repetition and the four-way table
Counting codes depends on two questions: does order matter, and can items repeat? For a lock or password the answer is “yes, order matters”. Repetition depends on the rule.
- Order matters, repetition allowed: n^k (for example 10⁴ = 10,000 PINs).
- Order matters, no repetition: n × (n − 1) × … × (n − k + 1) (for example 5,040 distinct-digit codes).
- Order does not matter, no repetition: the combination count, such as choosing which 3 of 10 buttons are pressed.
- Order does not matter, repetition allowed: handled by a separate method, stars and bars.
Some keypad-style locks work on the third pattern: the code is a set of buttons pressed together, so pressing 1, 3 and 5 in any order is the same code. Choosing 3 of 10 buttons gives 10 × 9 × 8 ÷ 6 = 120 codes, far fewer than the 720 ordered sequences (10 × 9 × 8), because each set of three buttons is counted once, not six times.
Why this matters beyond locks
The same arithmetic shows up in games. A secret code in a board game with 4 pegs and 6 colours has 6⁴ = 1,296 possible patterns when colours may repeat, and 6 × 5 × 4 × 3 = 360 when they may not. Dice sequences, loot tables and sequences of button presses all grow the same way: multiply the options at each step. The idea of multiplying independent stages is introduced in the pillar discussion of counting principles, and it connects to the way factorials appear when every item must be used exactly once.
In probability terms, if all codes are equally likely and you guess one at random, your chance of getting the code on a single attempt is 1 divided by the number of codes. For a four-digit PIN that is 1 in 10,000, or 0.01 percent. That is a statement about a single guess, not a prediction about how a particular person will behave. Counting is the first step toward judging how likely any outcome is, and it connects to ideas like picturing tiny odds, where very large counts make single outcomes feel remote.
Key takeaways
- Multiply the number of options in each position to count codes.
- Each added position multiplies the total, so length matters more than most other choices.
- Larger character sets help, but less than extra length does.
- Rules that forbid repetition shrink the count.
- Human choices are not uniform, so the full count overstates real-world difficulty of guessing.