Skip to content
ENExplore Calculators

Password Hygiene Score Calculator

Roll uniqueness, MFA coverage, length, breach exposure and manager use into one 0–100 password hygiene score.

About Password Hygiene Score Calculator

Uniqueness and MFA carry the most weight because they are the two controls that stop one leaked password becoming many compromised accounts. Breach presence is penalised four points per percent, since those credentials are already usable. Length is scored against a 16-character target rather than a policy minimum. Hygiene is a portfolio property, not a per-password one, so a single weighted score is what you can trend quarterly and hand to a risk committee.

Formula

Password Hygiene Score

score = 0.22 × uniqueness + 0.22 × MFA coverage + 0.18 × breach-free share + 0.14 × length score + 0.14 × manager adoption + 0.10 × shared-account score.

length score
Average length ÷ 16, capped at 100
breach-free share
100 − 4 × the percentage found in breach corpora

Worked example

With the default values below, Password Hygiene Score Calculator returns Password Hygiene Score of 70.5. Change any input above and every figure here is recalculated in your browser.

Inputs used

Passwords that are uniqueaccepts 0–100 %
65 %
Accounts with MFAaccepts 0–100 %
80 %
Average password lengthaccepts 1–64 characters
12 characters
Passwords found in breach corporaaccepts 0–100 %
8 %
Users on a password manageraccepts 0–100 %
60 %
Accounts with shared passwordsaccepts 0–100 %
5 %

Results

Password Hygiene Score
70.5 / 100
Grade
C — Fair
Weakest Area
Password manager adoption
Entropy at the Average Length
78.8 bits
Points Available to Gain
29.5 points

Step by step

  1. 1Values used
  2. 2Password Hygiene Score
  3. 3Password Hygiene Score= 70.5 / 100
  4. 4Grade= C — Fair
  5. 5Weakest Area= Password manager adoption
  6. 6Entropy at the Average Length= 78.8 bits
  7. 7Points Available to Gain= 29.5 points

Assumptions and limits

  • The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Password Hygiene Score calculated?

score = 0.22 × uniqueness + 0.22 × MFA coverage + 0.18 × breach-free share + 0.14 × length score + 0.14 × manager adoption + 0.10 × shared-account score. Uniqueness and MFA carry the most weight because they are the two controls that stop one leaked password becoming many compromised accounts. Breach presence is penalised four points per percent, since those credentials are already usable. Length is scored against a 16-character target rather than a policy minimum.

Why does Password Hygiene Score matter?

Hygiene is a portfolio property, not a per-password one, so a single weighted score is what you can trend quarterly and hand to a risk committee.

What values do I need to enter?

This calculator takes 6 inputs: Passwords that are unique, Accounts with MFA, Average password length, Passwords found in breach corpora, Users on a password manager, Accounts with shared passwords. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is uniqueness weighted as heavily as MFA?

Because they fail in opposite directions and neither substitutes for the other. Unique passwords limit the blast radius when a site leaks; MFA stops a leaked password from completing a login. Fixing only one leaves the other failure mode wide open.

How do I measure the breach-exposure figure?

Compare password hashes against a breach corpus using a k-anonymity range query so no full hash leaves your environment, or use the directory's built-in banned-password check. Most enterprises find between 2 % and 10 % on the first pass.

Related Calculators

Password Hygiene Score Calculator | Calcrivo