Security Question Strength Calculator

entropy = questions × log2(plausible answers); P(guessed) = (1 − (1 − 1 ÷ answers)^guesses)^questions. Knowledge-based answers draw from a tiny, skewed space — Google's 2015 study recovered 19.7 % of English-speaking users' favourite-food answers in a single guess. Two questions at 500 plausible answers each give under 18 bits, less than three random ASCII characters, and the dominant failure is not guessing at all but the answer simply being findable online.

Security questions usually sit on the account-recovery path, which means they are an alternative authenticator that bypasses your password and MFA entirely — so their strength caps the strength of the whole account.

This calculator takes 4 inputs: Plausible answers per question, Questions the user must answer, Guesses allowed per question, Chance an answer is publicly discoverable. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Only as one signal among several, never as a standalone reset path, and best when the answer is a random string stored in a password manager. At that point it is just a second password, which is a reasonable way to use the field.

Because it is not a guessing problem. If the answer is on a public profile the attacker needs zero attempts, so no rate limit or lockout policy helps — which is why this term dominates the result.