Password Hygiene Score Calculator

score = 0.22 × uniqueness + 0.22 × MFA coverage + 0.18 × breach-free share + 0.14 × length score + 0.14 × manager adoption + 0.10 × shared-account score. Uniqueness and MFA carry the most weight because they are the two controls that stop one leaked password becoming many compromised accounts. Breach presence is penalised four points per percent, since those credentials are already usable. Length is scored against a 16-character target rather than a policy minimum.

Hygiene is a portfolio property, not a per-password one, so a single weighted score is what you can trend quarterly and hand to a risk committee.

This calculator takes 6 inputs: Passwords that are unique, Accounts with MFA, Average password length, Passwords found in breach corpora, Users on a password manager, Accounts with shared passwords. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because they fail in opposite directions and neither substitutes for the other. Unique passwords limit the blast radius when a site leaks; MFA stops a leaked password from completing a login. Fixing only one leaves the other failure mode wide open.

Compare password hashes against a breach corpus using a k-anonymity range query so no full hash leaves your environment, or use the directory's built-in banned-password check. Most enterprises find between 2 % and 10 % on the first pass.