A/B Password Strength Per-User Formula
Learn how the calculator estimates password compromise likelihood per targeted account and compares expected affected accounts under two policies.
This calculator applies the same attack scenario to policy A and policy B, then estimates how likely one targeted account is to be compromised. It scales that per-user estimate by the targeted user count to show the relative expected impact of each password policy.
- 100% Free
- No Sign-Up Required
- Private & Secure
- Mobile Friendly
Per-User Compromise Likelihood
Where:
Multiply the attacker's guesses per second by the attack duration in seconds. Divide that total by the estimated average guesses needed for a password with the stated entropy, then cap the result at 100%.
Variables Explained
| Variable | What It Means | Unit |
|---|---|---|
| P - Per-user compromise likelihood | Estimated likelihood that one targeted account is compromised during the stated attack period. | percent |
| G - Attack guesses per second | Assumed rate at which the attacker can make password guesses. | guesses/second |
| D - Attack duration | Number of days the attacker can continue guessing. | days |
| E - Password entropy | Estimated average effective password entropy under the policy being tested. | bits |
| N - Active user accounts | Number of accounts in scope for the comparison. | accounts |
| C - Accounts targeted | Percentage of active accounts assumed to be included in the attack. | percent |
Step-by-Step Calculation
Estimate targeted accounts
This limits the population impact estimate to the accounts assumed to be targeted.
targetedUsers = activeUsers * (attackCoverage / 100)
Convert days to seconds
Guess rate is measured per second, so the attack period must be converted from days.
attackSeconds = attackDurationDays * 86400
Calculate available guesses
This is the maximum number of password guesses available in the scenario.
totalGuesses = guessesPerSecond * attackSeconds
Estimate average guesses for each policy
The model uses half of the effective password search space as a simplified average-guess estimate.
averageGuesses = pow(2, entropyBits - 1)
Calculate compromise likelihood
Available guesses are compared with the average guesses required, with the likelihood capped at 100%.
compromiseProbability = min(100, (totalGuesses / averageGuesses) * 100)
Estimate affected accounts
The per-user likelihood is multiplied by targeted accounts to estimate expected affected accounts.
expectedCompromised = targetedUsers * (compromiseProbability / 100)
Estimate the reduction from policy B
This shows the modelled reduction when policy B has lower estimated risk than policy A.
accountsAvoided = max(0, expectedCompromisedA - expectedCompromisedB)
Comparing 40-bit and 55-bit password policies
Convert the attack period
30 × 86,400
2,592,000 seconds
Calculate total guesses
10,000 × 2,592,000
25,920,000,000 guesses
Calculate policy A average guesses
2^(40 − 1)
549,755,813,888 guesses
Calculate policy A likelihood
(25,920,000,000 ÷ 549,755,813,888) × 100
4.7148%
Calculate policy B likelihood
(25,920,000,000 ÷ 2^(55 − 1)) × 100
0.0001439%
Scale to 10,000 targeted accounts
10,000 × 4.7148% versus 10,000 × 0.0001439%
471.48 versus 0.01 expected accounts
Final Result
Under these assumptions, policy B avoids an estimated 471.47 compromised accounts compared with policy A.
Assumptions
- ✓Entropy values represent the average effective password strength users actually achieve under each policy.
- ✓The attacker makes guesses at a constant rate throughout the entire attack period.
- ✓Each targeted account has similar exposure and password-strength characteristics.
- ✓The simplified model uses half of the password search space as the average guess count.
- ✓Policy A and policy B are tested against the same user population and attack scenario.
Limitations
- !The estimate does not model password reuse, breached credentials, phishing, malware, session theft, or account recovery weaknesses.
- !Actual guessing rates can vary widely with online rate limits, password hashing, hardware, and attacker resources.
- !Entropy estimates may not reflect real user password choices or predictable password patterns.
- !A capped likelihood of 100% is a modelling limit, not a guarantee that every account will be compromised.
- !Expected affected accounts are statistical estimates and may not equal the outcome of a specific incident.
Common Mistakes to Avoid
Entering a raw hash-cracking rate for an online login scenario that has rate limiting.
Treating password length alone as the same thing as effective entropy.
Using a policy requirement instead of the average strength users actually choose.
Comparing policies with different attack durations or guess rates, which makes the A/B result less comparable.
Reading an expected account count as a certain number of compromises.
Ignoring controls such as multi-factor authentication and secure password recovery.
Related Formulas
Frequently Asked Questions
How is password compromise probability calculated?
The calculator divides total attacker guesses by the estimated average guesses needed for the password entropy level, converts the ratio to a percentage, and caps it at 100%.
Why does the formula use 2 raised to entropy minus 1?
An entropy value of E bits represents an effective search space of 2^E combinations. The model uses half that space, 2^(E − 1), as a simplified average search effort.
What happens when policy B has more entropy bits than policy A?
Each additional bit doubles the effective search space. Under identical attack assumptions, higher entropy therefore reduces the simplified compromise estimate exponentially.
Why is compromise likelihood capped at 100%?
A probability cannot exceed 100%. The cap prevents a very large guess budget from producing an impossible percentage.
Is this formula suitable for online and offline attacks?
It can illustrate either scenario if the guess rate is chosen appropriately, but actual online rate limits and offline cracking performance can differ substantially.
Ready to calculate your result?
Use the calculator to get instant results with your own inputs.