Phishing Click Rate Calculator

Work out phishing click rate instantly with clear inputs, formula shown and shareable results.

About Phishing Click Rate Calculator

Click rate alone is a poor programme metric because it can be driven down by making simulations obvious. The pair that matters is credential submission rate, which measures actual compromise, and report rate, which measures whether the workforce is generating the early-warning signal your security team depends on. A rising report-to-click ratio is the clearest sign a programme is working.

Formula

Phishing simulation metrics

click rate = clicks / sent; submission rate = credential submissions / sent; report rate = reports / sent; ratio = reports / clicks

Worked example

With the default values below, Phishing Click Rate Calculator returns Click rate of 8.40%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Simulated phishing emails sentminimum 1: 5,000
Recipients who clickedminimum 0: 420
Recipients who submitted credentialsminimum 0: 95
Recipients who reported the emailminimum 0: 1,100

Results

Click rate: 8.40%
Credential submission rate: 1.90%
Report rate: 22.00%
Reports per click: 2.62

Step by step

1Values used
2Phishing simulation metrics
3Click rate= 8.40
4Credential submission rate= 1.90
5Report rate= 22.00
6Reports per click= 2.62

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

What click rate is normal?

Industry baselines commonly start near 25 to 30 percent for untrained populations and fall into single digits with sustained training, though results depend heavily on how convincing the lure is.

Why measure reporting?

Detection speed depends on it. A workforce that reports a campaign within minutes lets you block the sender and reset credentials before an attacker gets far, regardless of how many clicked.