A/B Testing Password Strength (Per-User) Calculator Examples
Worked password-policy comparison examples using entropy, attack duration, guessing rate, and targeted account counts.
These examples show how changing password entropy, attack capacity, and attack coverage affects the estimated per-user compromise likelihood and the expected number of affected accounts. They are simplified comparisons, not predictions of a real security incident.
Online attack with rate limiting
A service has 50,000 active accounts, but an attacker can make only 10 guesses per second for 30 days and targets 20% of accounts.
Input Summary
Active accounts
50,000
Targeted accounts
20%
Policy A entropy
35 bits
Policy B entropy
45 bits
Guess rate
10 guesses/second
Attack duration
30 days
Calculation Breakdown
- 1Targeted users50,000 × 20%10,000 accounts
- 2Total guesses10 × 30 × 86,40025,920,000 guesses
- 3Policy A likelihood25,920,000 ÷ 2^34 × 1000.1509%
- 4Policy B likelihood25,920,000 ÷ 2^44 × 1000.0001473%
- 5Expected impact10,000 × each likelihood15.09 versus 0.01 accounts
Result Summary
Total guesses
25,920,000 guesses
A/B Testing Password Strength (Per-User) Calculator
Policy A produces about 15.09 expected compromised accounts, while policy B produces about 0.01 under the same limited online attack scenario.
Offline attack against a large account population
A business compares a 40-bit policy with a 55-bit policy across 10,000 targeted accounts for 30 days.
Input Summary
Active accounts
10,000
Targeted accounts
100%
Policy A entropy
40 bits
Policy B entropy
55 bits
Guess rate
10,000 guesses/second
Attack duration
30 days
Calculation Breakdown
- 1Attack duration30 × 86,4002,592,000 seconds
- 2Total guesses10,000 × 2,592,00025,920,000,000 guesses
- 3Policy A likelihood25,920,000,000 ÷ 2^39 × 1004.7148%
- 4Policy B likelihood25,920,000,000 ÷ 2^54 × 1000.0001439%
- 5Expected accounts avoided471.48 − 0.01471.47 accounts
Result Summary
Total guesses
25,920,000,000 guesses
A/B Testing Password Strength (Per-User) Calculator
The model estimates 471.48 affected accounts for policy A and 0.01 for policy B.
Short attack window versus stronger policy
An application with 200,000 active accounts expects 5% of accounts to be targeted during a seven-day attack at 1,000 guesses per second.
Input Summary
Active accounts
200,000
Targeted accounts
5%
Policy A entropy
38 bits
Policy B entropy
48 bits
Guess rate
1,000 guesses/second
Attack duration
7 days
Calculation Breakdown
- 1Targeted users200,000 × 5%10,000 accounts
- 2Total guesses1,000 × 7 × 86,400604,800,000 guesses
- 3Policy A likelihood604,800,000 ÷ 2^37 × 1000.4401%
- 4Policy B likelihood604,800,000 ÷ 2^47 × 1000.0004298%
- 5Expected impact10,000 × each likelihood44.01 versus 0.04 accounts
Result Summary
Total guesses
604,800,000 guesses
A/B Testing Password Strength (Per-User) Calculator
Policy B reduces the estimate from about 44.01 to 0.04 expected compromised accounts in the targeted group.
How to Read Your Results
Per-user compromise likelihood applies to one targeted account, not every active account.
Expected compromised accounts equals the targeted account count multiplied by the estimated per-user likelihood.
Compare policy A and policy B only when all other scenario inputs are held constant.
Very small percentages may still become meaningful when applied to a large targeted population.
Use the result as a sensitivity estimate; test several plausible guess rates and attack durations.
Assumptions & Important Notes
- Password entropy is an average effective value for each policy rather than a guaranteed minimum for every user.
- The same attack rate, duration, and target coverage apply to both policies in each example.
- The attack model assumes independent password guesses and uniform account exposure.
- The examples exclude non-password account takeover paths.
Related Examples
Frequently Asked Questions
Why do examples use expected accounts instead of a guaranteed count?
The output applies an estimated probability across a population, so it represents an expected value rather than a guaranteed incident outcome.
Can I use a smaller targeted-account percentage?
Yes. Use the percentage that fits the scenario, then interpret the population output as applying only to that targeted group.
How much does one extra entropy bit change the result?
In this model, one additional bit doubles the effective search space and approximately halves an uncapped compromise estimate.
Should the same guess rate be used for both policies?
Yes, for a direct A/B policy comparison. Changing the attack scenario at the same time obscures the effect of the policy change.
Ready to calculate your own result?
Use the live calculator with your own inputs, timing, and preferences.