Password Reuse Risk Calculator

accounts per password = accounts ÷ distinct passwords; reuse rate = 1 − (distinct passwords ÷ accounts); P(at least one breach) = 1 − (1 − p)^accounts. Reuse converts one site's breach into a compromise of every account sharing that password, so the blast radius is simply accounts divided by distinct passwords. The portfolio breach probability compounds: at 1.5 % per site, holding 85 accounts makes it more likely than not that one of them leaks within the year.

Reuse, not weak passwords, is what actually drives account takeover — credential stuffing only works because the same password is waiting on another site.

This calculator takes 4 inputs: Online accounts you hold, Distinct passwords in use, Annual breach chance per site, Accounts protected by MFA. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Independent small risks compound. Each site is unlikely to leak, but 1 − 0.985^85 is about 72 %. The number of accounts is the multiplier you cannot reduce, so the lever is making sure a leak only ever costs you one account.

It contains it rather than fixing it. MFA stops the stolen password from completing a login on the accounts that have it, which is why it lowers the risk band here — but the password is still valid, still for sale, and still working on every account without MFA.