Variations with Repetition Calculator

How many four-digit PINs exist?

A standard bank PIN uses digits 0 through 9, giving 10 possible digits per position. With 4 positions and repetition allowed (the same digit can appear more than once), the total number of PINs is 10 x 10 x 10 x 10 = 10,000. That single multiplication captures the essence of variations with repetition. This calculator generalises that idea to any number of elements and any number of positions, and adds a comparison with the case where repetition is not allowed.

n^k

variations with repetition

n!/(n-k)!

permutations without repetition

1B/s

brute force rate assumed

The two formulas explained

Combinatorics draws a sharp line between two scenarios: whether you are allowed to reuse an element or not.

Type	Formula	Repetition allowed?	Typical use
Variations with repetition	V'(n,k) = n^k	Yes	PIN codes, passwords, dice rolls
Permutations without repetition	V(n,k) = n! / (n-k)!	No	Race finishing orders, safe combinations, unique codes

The key insight: when repetition is allowed, every position is independent and always has n choices. When repetition is forbidden, each successive position has one fewer choice because the previously chosen element is removed.

Common examples reference table

Scenario	n	k	V'(n,k) = n^k	V(n,k) no repeat
4-digit PIN (digits 0-9)	10	4	10,000	5,040
8-char password (a-z only)	26	8	208,827,064,576	62,990,928,000
6-char password (a-z + 0-9)	36	6	2,176,782,336	1,402,410,240
7-digit phone number (0-9)	10	7	10,000,000	604,800
3-digit combination lock (0-9)	10	3	1,000	720
6-char plate (A-Z + 0-9)	36	6	2,176,782,336	1,402,410,240

Practical examples

Example 1 - bank PIN code
A 4-digit PIN uses digits 0-9 (n = 10) and allows the same digit to appear more than once (e.g. 1111 is valid). This is variations with repetition: V'(10, 4) = 10^4 = 10,000. If you were forced to use four different digits, you would have V(10, 4) = 10 x 9 x 8 x 7 = 5,040 options - almost half as many.

Example 2 - lowercase password
An 8-character password using only lowercase English letters (n = 26): V'(26, 8) = 26^8 = 208,827,064,576 - over 208 billion combinations. At 1 billion guesses per second a computer would need about 3.5 minutes on average to crack it. Mixing in uppercase letters and digits raises n to 62 and the count to 26^8 is dwarfed by 62^8 = 218,340,105,584,896, which takes years.

Example 3 - dice rolls
Rolling a standard six-sided die 3 times gives n = 6, k = 3: V'(6, 3) = 6^3 = 216 possible sequences. Each outcome (e.g. 3-1-6) is distinct from (6-1-3) because order matters. If you wanted three rolls all showing different faces, that would be V(6, 3) = 6 x 5 x 4 = 120 sequences.

Example 4 - colour code (RGB byte)
An RGB colour is three independent bytes, each with values 0-255 (n = 256). The total number of possible colours is V'(256, 3) = 256^3 = 16,777,216 - exactly the 16.7 million colours of 24-bit colour space. Since each byte is independent and repeats are allowed, this is a textbook variations-with-repetition problem.

Example 5 - race finishing order
Eight runners compete. How many different top-3 finishing orders are there? Each position must be a different runner, so no repetition: V(8, 3) = 8 x 7 x 6 = 336. The calculator shows this as the "permutations without repetition" result when you enter n = 8, k = 3.

Example 6 - how repetition multiplies the count
For n = 10, k = 4 the ratio V'(n,k) / V(n,k) = 10,000 / 5,040 = 1.98x. For n = 26, k = 8 the ratio is 208,827,064,576 / 62,990,928,000 = 3.32x. The more positions and the smaller the alphabet, the bigger the gap between the two formulas. The calculator always displays this ratio so you can immediately see how much repetition adds.

Security classification explained

Space size (V')	Classification	Practical meaning
Up to 100	Very small space - can be checked manually	A human can try every option by hand in minutes
101 - 1,000	Small space - easy to guess	A script cracks it in milliseconds
1,001 - 100,000	Medium space - a computer cracks it in seconds	Acceptable only with strict rate limiting
100,001 - 1 billion	Large space - requires time or a clever method	Seconds to minutes without rate limiting
1B - 1 trillion	Huge space - brute force takes minutes to hours	Reasonable for low-value secrets with no lockout
Over 1 trillion	Enormous space - practically immune to brute force	Years to centuries even with dedicated hardware

Note: the brute-force estimate assumes 1 billion attempts per second on a single machine with no rate limiting or lockout. Real-world login systems enforce lockouts after a few failed attempts, which makes even small spaces effectively uncrackable through a live interface. The estimate is most relevant for offline attacks against stolen password hashes.

When to use which formula

The choice between the two formulas comes down to one question: can the same element appear more than once?

Use variations with repetition (n^k) when an element can be reused: PIN codes, passwords, dice sequences, binary strings, colour channels, lottery ticket numbers where you pick the same number twice.
Use permutations without repetition (n!/(n-k)!) when each element can appear at most once: finishing orders in a race, arranging books on a shelf, selecting officers from a club, dealing unique playing cards.
If k = n and repetition is forbidden, the formula simplifies to n! (a full permutation): the number of ways to arrange all n elements in a row.
If order does not matter (only which elements are chosen, not in what sequence), you need combinations C(n, k) = n! / (k! x (n-k)!) instead of variations.

How the brute-force time is calculated

The calculator divides the total number of arrangements (n^k) by an assumed attack rate of 1,000,000,000 guesses per second (1 billion per second). This represents a typical speed for a modern CPU cracking a fast hash like MD5 or for trying PINs over a local interface without a lockout.

GPU clusters can reach 10 to 100 billion guesses per second for fast hashes, which would reduce the time estimates by a factor of 10 to 100. Slow hashes like bcrypt or Argon2 can be limited to fewer than 1,000 guesses per second per GPU, increasing the effective time by a factor of one million or more. Use the brute-force estimate as a rough benchmark, not a guarantee.

FAQ

What is the difference between a variation and a combination?

Both select k elements from a set of n. The difference is whether the order matters. Variations (permutations) count ordered sequences: (A, B, C) and (C, B, A) are different. Combinations count unordered subsets: {A, B, C} and {C, B, A} are the same. For the same n and k, the number of combinations is always smaller than the number of variations by a factor of k! (the number of ways to arrange k items). For PIN codes and passwords order matters, so variations are the right tool.

Why does my password feel unique even though n^k is only in the millions?

A space of one million sounds small, but context matters enormously. If a web form allows only 3 attempts before a 30-second lockout, an attacker can try at most 6 guesses per minute - meaning a space of one million passwords would take over 100 days to exhaust. The raw n^k number assumes zero friction. Real security combines a large space with rate limiting, account lockouts, multi-factor authentication, and slow hashing of stored passwords. This calculator shows the space size so you understand the raw combinatorial protection, separate from other security layers.

What happens when k is greater than n and repetition is not allowed?

It is impossible to place more elements than exist without repeating. If you have 5 distinct letters and try to fill 6 positions without reusing any letter, you run out of letters before filling all positions. The formula V(n, k) = n! / (n-k)! is undefined for k greater than n in the non-repetition case (you get a factorial of a negative number). The calculator shows "0 (k > n)" in this situation. With repetition allowed, k can always exceed n because elements can be reused indefinitely.

How does adding one character to a password change the count?

Each extra position multiplies the total by n. For a lowercase-only password (n = 26): 6 characters = 26^6 = 308,915,776; 7 characters = 26^7 = 8,031,810,176; 8 characters = 26^8 = 208,827,064,576. Going from 6 to 7 characters multiplies the space by 26. Going from 7 to 8 multiplies it by 26 again. This is why password length is so powerful - each additional character provides a multiplicative increase, not an additive one.

How does expanding the character set compare to adding length?

Adding one character to the alphabet increases n by 1, while adding one position multiplies the space by n. For an 8-character password: switching from lowercase only (n = 26) to lowercase plus digits (n = 36) gives 36^8 = 2,821,109,907,456 vs 26^8 = 208,827,064,576 - a factor of about 13.5x. Adding one more character at n = 26 gives 26^9 = 5,429,503,678,976 - a factor of about 26x improvement. In this case, adding length wins over adding one character class. The crossover depends on the specific n and k values - use the calculator to compare both strategies.

Can this calculator handle very large numbers?

JavaScript numbers are 64-bit floating-point (IEEE 754 double precision), which gives exact integer representation up to 2^53 = 9,007,199,254,740,992 (about 9 quadrillion). Above that threshold, the calculator switches to scientific notation (e.g. 1.21 x 10^17) and the displayed value may be rounded. For practical combinatorics questions such as PIN codes, passwords up to about 15 characters with reasonable alphabets, and most counting problems the precision is fully exact. Extremely large spaces (n = 256, k = 100) are shown in scientific notation with two decimal places of the mantissa.

What does "variations" mean - is it the same as "permutations"?

In most English-language combinatorics textbooks the term "permutation of n elements taken k at a time" covers both cases (with and without repetition), distinguished by context. The term "variation" is more common in European curricula (French, German, Polish, Czech, Spanish) and explicitly separates the two cases: variations with repetition (n^k) and variations without repetition (n!/(n-k)!). This calculator uses the European terminology because it provides cleaner naming. The underlying mathematics is identical regardless of the label.

Related tools

Combinatorics Calculator

Calculate factorials n! - the building block behind permutations and combinations - Open calculator

Probability Calculator

Calculate the probability of events as fraction, decimal, percentage and odds - Open calculator

Percentage Calculator

Calculate X% of a number, find what percent X is of Y, or compute percentage change - Open calculator

Factorial Calculator

Compute n! for any non-negative integer, used in permutation and combination formulas - Open calculator

Power Calculator

Compute any base raised to any exponent and extract roots - the core operation behind n^k - Open calculator

Variations with Repetition Calculator - PIN Codes, Passwords

Parameters