Glossary
Keyspace
The keyspace is the total number of candidate passwords a brute-force or mask attack has to try, growing exponentially with character set size and length.
The keyspace is the complete set of possible passwords a given attack could generate — every combination of the chosen character set, up to the chosen length. A 4-digit PIN has a keyspace of 10,000 (10⁴); an 8-character password drawn from lowercase letters, uppercase letters and digits has a keyspace above 218 trillion (62⁸). Each extra character or added character class multiplies the keyspace, which is why it grows exponentially rather than linearly.
Keyspace size is what separates a feasible mask attack from a hopeless one: a mode with 10 billion guesses per second clears a 10-billion-candidate keyspace in about a second, but the same keyspace raised to 12 characters instead of 8 can take centuries. This is also why a targeted wordlist beats blind brute force in practice — it tests a tiny, realistic slice of the keyspace instead of all of it.
The keyspace is a property of the attack, not the hash. A slow, iterated hash such as bcrypt does not shrink the keyspace; it just makes each guess inside it far more expensive to test.