Password Manager Coverage Calculator

credential coverage = vaulted credentials ÷ (employees × credentials per user); activation = active users ÷ licences deployed. Three different numbers get called adoption. Deployment is how many people have a licence, activation is how many use it, and coverage is the share of credentials it holds — the only one that maps to risk. A tool at 79 % deployment can still leave more than half of all credentials outside the vault.

Unvaulted credentials are the ones that get reused, written down or shared in chat, so coverage tells you how much of the reuse problem the rollout has genuinely retired.

This calculator takes 5 inputs: Employees in scope, Licences deployed, Users active in the last 30 days, Work credentials per user, Credentials stored in the vault. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because a licensed user typically vaults the logins they use daily and leaves the long tail — legacy systems, shared service accounts, vendor portals — wherever they already were. Closing that tail needs a discovery pass, not more licences.

Above 90 % of enumerated credentials, with shared and privileged accounts at 100 % and held in a privileged-access vault rather than a personal one. Below about 60 % the reuse rate barely moves.