Skip to content
ENExplore Calculators

Password Reuse Risk Calculator

Quantify the blast radius of password reuse: accounts per password, reuse rate and the odds one of them is breached this year.

About Password Reuse Risk Calculator

Reuse converts one site's breach into a compromise of every account sharing that password, so the blast radius is simply accounts divided by distinct passwords. The portfolio breach probability compounds: at 1.5 % per site, holding 85 accounts makes it more likely than not that one of them leaks within the year. Reuse, not weak passwords, is what actually drives account takeover — credential stuffing only works because the same password is waiting on another site.

Formula

Password Reuse Risk

accounts per password = accounts ÷ distinct passwords; reuse rate = 1 − (distinct passwords ÷ accounts); P(at least one breach) = 1 − (1 − p)^accounts.

p
Annual breach probability of a single site
accounts
How many sites hold one of your credentials

Worked example

With the default values below, Password Reuse Risk Calculator returns Accounts Exposed per Leaked Password of 7. Change any input above and every figure here is recalculated in your browser.

Inputs used

Online accounts you holdaccepts 1–5,000 accounts
85 accounts
Distinct passwords in useaccepts 1–5,000 passwords
12 passwords
Annual breach chance per siteaccepts 0–100 %
1.5 %
Accounts protected by MFAaccepts 0–100 %
40 %

Results

Accounts Exposed per Leaked Password
7 accounts
Password Reuse Rate
85.9%
Accounts per Password
7.08
Chance of a Breach This YearAcross your whole account portfolio
72.3%
Risk Band
High

Step by step

  1. 1Values used
  2. 2Password Reuse Risk
  3. 3Accounts Exposed per Leaked Password= 7 accounts
  4. 4Password Reuse Rate= 85.9
  5. 5Accounts per Password= 7.08
  6. 6Chance of a Breach This Year= 72.3
  7. 7Risk Band= High

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or fees or charges into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Password Reuse Risk calculated?

accounts per password = accounts ÷ distinct passwords; reuse rate = 1 − (distinct passwords ÷ accounts); P(at least one breach) = 1 − (1 − p)^accounts. Reuse converts one site's breach into a compromise of every account sharing that password, so the blast radius is simply accounts divided by distinct passwords. The portfolio breach probability compounds: at 1.5 % per site, holding 85 accounts makes it more likely than not that one of them leaks within the year.

Why does Password Reuse Risk matter?

Reuse, not weak passwords, is what actually drives account takeover — credential stuffing only works because the same password is waiting on another site.

What values do I need to enter?

This calculator takes 4 inputs: Online accounts you hold, Distinct passwords in use, Annual breach chance per site, Accounts protected by MFA. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does the yearly breach chance get so high?

Independent small risks compound. Each site is unlikely to leak, but 1 − 0.985^85 is about 72 %. The number of accounts is the multiplier you cannot reduce, so the lever is making sure a leak only ever costs you one account.

Does MFA fix reuse?

It contains it rather than fixing it. MFA stops the stolen password from completing a login on the accounts that have it, which is why it lowers the risk band here — but the password is still valid, still for sale, and still working on every account without MFA.

Related Calculators

Password Reuse Risk Calculator | Calcrivo