Skip to content
ENExplore Calculators

Security Question Strength Calculator

Measure how weak knowledge-based answers really are, combining guessability with the chance the answer is public.

About Security Question Strength Calculator

Knowledge-based answers draw from a tiny, skewed space — Google's 2015 study recovered 19.7 % of English-speaking users' favourite-food answers in a single guess. Two questions at 500 plausible answers each give under 18 bits, less than three random ASCII characters, and the dominant failure is not guessing at all but the answer simply being findable online. Security questions usually sit on the account-recovery path, which means they are an alternative authenticator that bypasses your password and MFA entirely — so their strength caps the strength of the whole account.

Formulas

Security Question Strength

entropy = questions × log2(plausible answers); P(guessed) = (1 − (1 − 1 ÷ answers)^guesses)^questions.

plausible answers
Size of the realistic answer space, not the dictionary
questions
How many must be answered correctly

Combined compromise probability

P(compromise) = P(public) + (1 − P(public)) × P(guessed), where P(public) = public share ^ questions.

Worked example

With the default values below, Security Question Strength Calculator returns Chance the Recovery Path Falls of 16.01%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Plausible answers per questionaccepts 2–10,000,000 answers
500 answers
Questions the user must answeraccepts 1–5 questions
2 questions
Guesses allowed per questionaccepts 1–1,000 guesses
5 guesses
Chance an answer is publicly discoverableaccepts 0–100 %
40 %

Results

Chance the Recovery Path Falls
16.01%
Combined Answer Entropy
17.93 bits
Equivalent Random ASCII Characters
2.73 characters
Chance from Public Research Alone
16.00%
Verdict
Weak — acceptable only as a secondary signal, never as a reset path

Step by step

  1. 1Values used
  2. 2Security Question Strength
  3. 3Combined compromise probability
  4. 4Chance the Recovery Path Falls= 16.01
  5. 5Combined Answer Entropy= 17.93 bits
  6. 6Equivalent Random ASCII Characters= 2.73 characters
  7. 7Chance from Public Research Alone= 16.00
  8. 8Verdict= Weak — acceptable only as a secondary signal, never as a reset path

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Security Question Strength calculated?

entropy = questions × log2(plausible answers); P(guessed) = (1 − (1 − 1 ÷ answers)^guesses)^questions. Knowledge-based answers draw from a tiny, skewed space — Google's 2015 study recovered 19.7 % of English-speaking users' favourite-food answers in a single guess. Two questions at 500 plausible answers each give under 18 bits, less than three random ASCII characters, and the dominant failure is not guessing at all but the answer simply being findable online.

Why does Security Question Strength matter?

Security questions usually sit on the account-recovery path, which means they are an alternative authenticator that bypasses your password and MFA entirely — so their strength caps the strength of the whole account.

What values do I need to enter?

This calculator takes 4 inputs: Plausible answers per question, Questions the user must answer, Guesses allowed per question, Chance an answer is publicly discoverable. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Can security questions ever be used safely?

Only as one signal among several, never as a standalone reset path, and best when the answer is a random string stored in a password manager. At that point it is just a second password, which is a reasonable way to use the field.

Why count public discoverability separately?

Because it is not a guessing problem. If the answer is on a public profile the attacker needs zero attempts, so no rate limit or lockout policy helps — which is why this term dominates the result.

Related Calculators

Security Question Strength Calculator | Calcrivo