The mathematical part was not obvious to me, so: The derivative with respect to a is: b(a^(b-1)). The derivative with respect to b is: log(a)(a^b) or (a log(a

The mathematical part was not obvious to me, so: The derivative with respect to a is: b(a^(b-1)). The derivative with respect to b is: log(a)(a^b) or (a log(a))(a^(b-1)). So it's better to increase b when alog(a) > b. Which is typically the case where a is 26 for lowercased letters and b is like 10 for password length. This analysis might not be totally correct since the cost of adding one extra allowed character vs increasing password length by one is not the same but w/e.