A/B Testing Password Strength (Per-User) Calculator
Compare two password-strength policies by estimating per-user compromise likelihood and the expected number of affected accounts under the same attack scenario.
Overview
Use this A/B password strength calculator to compare two password policies using estimated entropy, attacker guess rate, attack duration, and the number of accounts at risk. It estimates the likelihood of compromise for one targeted user and the potential impact across your selected user base.
How it works
The calculator converts the attack period into seconds and multiplies it by the assumed guess rate to estimate the total number of password guesses. For each policy, it estimates the average guesses needed to find a password as half of the possible combinations represented by its entropy value. Total guesses are then compared with that average to produce a capped, simplified compromise likelihood per targeted account. That likelihood is multiplied by the number of targeted accounts to estimate the expected impact. This is useful for comparing policies under identical assumptions, but it is not a full threat model.
How to use this calculator
- 1Enter the number of active user accounts in scope.
- 2Estimate the average password entropy for policy A and policy B.
- 3Enter an attack guess rate appropriate to your threat scenario.
- 4Set the length of time the attacker can continue guessing.
- 5Choose the percentage of accounts likely to be targeted.
- 6Compare the per-user likelihood and expected affected-account estimates.
Example Calculation
Active user accounts
10000
Policy A password entropy
40
Policy B password entropy
55
Attack guesses per second
10000
Attack duration
30
Accounts targeted
100%
Policy A per-user compromise likelihood
4.7148%
With 10,000 accounts, 10,000 guesses per second, and a 30-day attack window, the 55-bit policy produces a far lower estimated per-user compromise likelihood than the 40-bit policy under the same assumptions.
Frequently asked questions
What is password entropy in bits?
Password entropy is a way to express the size and unpredictability of the effective password search space. More bits generally indicate that more guesses are needed to find a password.
Why does the calculator estimate risk per user?
A per-user estimate helps compare the effect of two password policies on an individual targeted account before scaling the result to a user population.
How should I choose an attacker guess rate?
Use a rate that matches the scenario. Online login attacks may be heavily limited, while a stolen password database may allow much faster offline guessing depending on the hashing method.
Does a longer password always have more entropy?
Not necessarily. Length can improve strength, but predictable patterns, common phrases, and password reuse can greatly reduce effective entropy.
Does multi-factor authentication make passwords unnecessary?
No. Multi-factor authentication can reduce the impact of a guessed password, but strong passwords, secure recovery flows, rate limiting, and safe password storage still matter.
Why are the results capped at 100%?
A compromise likelihood cannot exceed 100%. The cap prevents the simplified estimate from reporting an impossible value when the attack has enough guesses to exceed the average search effort.
Explore Related Calculators
Assumptions and warnings
Assumptions
- Password entropy values represent the average effective strength of passwords users actually choose under each policy.
- The attacker makes guesses at a constant rate for the full attack duration.
- The estimate assumes each password guess is independent and uses a simplified average-guess model.
- All targeted accounts are assumed to have similar exposure and password-strength characteristics.
- Results are estimates and do not account for password reuse, phishing, malware, session theft, or recovery-process weaknesses.
Warnings
- This calculator provides a simplified security estimate, not a guarantee of account safety.
- Actual password risk can differ substantially based on password storage, hashing, rate limiting, multi-factor authentication, breach exposure, and attacker capabilities.