A/B Testing Password Strength (Monthly) Calculator Examples
Worked examples showing how password-strength A/B tests can estimate monthly expected account compromises.
These examples use the same full-population comparison method as the calculator. They illustrate how account volume, weak-password rates, and risk assumptions can change the estimated impact of a password-strength test.
Balanced test with a large weak-password-rate improvement
Variant B reduces the weak-password rate from 30% to 15%, while risk assumptions remain 0.50% for weak passwords and 0.05% for stronger passwords.
Input Summary
Monthly active accounts
10,000
Variant A share
50%
Weak-password rate: A / B
30% / 15%
Weak / stronger password risk
0.50% / 0.05%
Calculation Breakdown
- 1Expected compromises in A group(5,000 × 30% × 0.50%) + (5,000 × 70% × 0.05%)9.25 accounts
- 2Expected compromises in B group(5,000 × 15% × 0.50%) + (5,000 × 85% × 0.05%)5.875 accounts
- 3Standardize to all accountsA: 9.25 × 2 = 18.5; B: 5.875 × 2 = 11.7518.5 vs 11.75 accounts/month
- 4Calculate reduction(18.5 − 11.75) / 18.5 × 10036.5%
Result Summary
Calculate reduction
36.5%
A/B Testing Password Strength (Monthly) Calculator
A full rollout of Variant B is estimated to avoid 6.8 compromises per month.
Uneven traffic split with a modest improvement
Variant B lowers the weak-password rate from 20% to 16%; weak-password risk is 0.40% and stronger-password risk is 0.08%.
Input Summary
Monthly active accounts
25,000
Variant A share
80%
Weak-password rate: A / B
20% / 16%
Weak / stronger password risk
0.40% / 0.08%
Calculation Breakdown
- 1Calculate A group result(20,000 × 20% × 0.40%) + (20,000 × 80% × 0.08%)28.8 accounts
- 2Calculate B group result(5,000 × 16% × 0.40%) + (5,000 × 84% × 0.08%)6.56 accounts
- 3Standardize each approachA: 28.8 × (25,000 / 20,000); B: 6.56 × (25,000 / 5,000)36.0 vs 32.8 accounts/month
- 4Find avoided compromises36.0 − 32.83.2 accounts/month
Result Summary
Calculate B group result
6.56 accounts
A/B Testing Password Strength (Monthly) Calculator
Variant B is estimated to avoid 3.2 compromises per month, an 8.9% reduction.
Small business test with a strong risk gap
The meter reduces weak passwords from 40% to 25%. Weak-password compromise risk is estimated at 1.00% monthly and stronger-password risk at 0.10%.
Input Summary
Monthly active accounts
2,000
Variant A share
50%
Weak-password rate: A / B
40% / 25%
Weak / stronger password risk
1.00% / 0.10%
Calculation Breakdown
- 1Calculate full-population risk for A2,000 × ((40% × 1.00%) + (60% × 0.10%))9.2 accounts/month
- 2Calculate full-population risk for B2,000 × ((25% × 1.00%) + (75% × 0.10%))6.5 accounts/month
- 3Find the difference9.2 − 6.52.7 accounts/month
- 4Calculate percentage reduction2.7 / 9.2 × 10029.3%
Result Summary
Calculate percentage reduction
29.3%
A/B Testing Password Strength (Monthly) Calculator
Variant B is estimated to avoid 2.7 compromises per month.
No modeled benefit when risk assumptions are equal
Variant A has a 35% weak-password rate and Variant B has a 10% rate. Both password categories are assigned a 0.20% monthly compromise risk.
Input Summary
Monthly active accounts
15,000
Variant A share
50%
Weak-password rate: A / B
35% / 10%
Weak / stronger password risk
0.20% / 0.20%
Calculation Breakdown
- 1Calculate A estimate15,000 × ((35% × 0.20%) + (65% × 0.20%))30 accounts/month
- 2Calculate B estimate15,000 × ((10% × 0.20%) + (90% × 0.20%))30 accounts/month
- 3Find avoided compromises30 − 300 accounts/month
Result Summary
Calculate B estimate
30 accounts/month
A/B Testing Password Strength (Monthly) Calculator
The estimated reduction is 0.0%, despite the lower weak-password rate in Variant B.
How to Read Your Results
Expected compromises may be fractional because they are probability-based estimates, not literal incident counts.
Compare the standardized Variant A and Variant B results, especially when the traffic split is not 50/50.
A positive avoided-compromises result favors Variant B under the entered assumptions; a negative result indicates higher modeled risk for B.
The percentage reduction is relative to the standardized Variant A estimate.
Review risk assumptions alongside the weak-password rates because they strongly affect the outcome.
Assumptions & Important Notes
- Each example applies one consistent definition of a weak password across both variants.
- Compromise probabilities are illustrative planning assumptions rather than observed guarantees.
- Test groups are assumed to be representative after random assignment.
- Other controls and attack conditions are assumed not to differ between variants.
Related Examples
Frequently Asked Questions
Why can the calculator show decimal compromised accounts?
It reports an expected value based on probability. For example, 6.8 represents an average modeled outcome across similar months, not a fraction of an actual incident.
Can I use an 80/20 traffic split?
Yes. The calculator scales each variant's result to the full account population to make the comparison like for like.
What does a negative compromises-avoided result mean?
It means Variant B has a higher estimated compromise count than Variant A under the supplied inputs.
Which inputs usually have the biggest effect?
The gap between weak and stronger password risk, the change in weak-password rate, and the size of the monthly account population typically have the largest effect.
Ready to calculate your own result?
Use the live calculator with your own inputs, timing, and preferences.