Calculator Inputs
Enter estimated characteristics only. Do not paste your real recovery answer into any shared system.
Example Data Table
| Scenario | Question Type | Exposure | Guessability | Reuse | Length | Estimated Outcome |
|---|---|---|---|---|---|---|
| Legacy consumer account | Mother's maiden name | 8.0 | 8.5 | 7.0 | 6 | Critical risk due to public and reusable facts. |
| Private custom cue | Nonsense memory cue | 1.0 | 1.5 | 0.0 | 14 | Low risk with strong uniqueness and privacy. |
| Employee self-service portal | First school | 5.0 | 6.0 | 3.0 | 10 | High risk unless paired with MFA and lockouts. |
Formula Used
The calculator combines intrinsic prompt exposure, public discoverability, social guessability, reuse, targeting pressure, uniqueness, entropy, throttling strength, and MFA coverage into one weighted score.
Entropy = Answer Length x log2(Character Set Size)
Entropy Risk = clamp(100 - ((Entropy / 80) x 100), 0, 100)
Risk Score = 0.18(Baseline) + 0.14(Public Exposure) + 0.14(Guessability) + 0.12(Reuse) + 0.10(Targeting) + 0.10(Uniqueness Gap) + 0.10(Entropy Gap) + 0.07(Lockout Gap) + 0.05(MFA Gap)
Scores near 100 indicate severe recovery weakness. Lower scores indicate better privacy, uniqueness, and layered protection.
How to Use This Calculator
- Choose the closest prompt type that matches the recovery question being assessed.
- Estimate public exposure and guessability without revealing the actual answer.
- Score uniqueness, reuse, targeting pressure, and lockout strength using a 0 to 10 scale.
- Enter the approximate answer length and the broad character variety used.
- Check whether MFA protects the account during login or recovery events.
- Press Calculate Risk to place the result summary above the form.
- Use the factor table and recommendations to replace weak prompts or strengthen recovery controls.
Frequently Asked Questions
1. Why are security questions considered risky?
Many answers rely on facts friends, relatives, or public records can uncover. Attackers also exploit social media, leaked profiles, and helpdesk shortcuts.
2. What does a high score mean?
A high score means the prompt is easier to research, infer, reuse, or brute force during recovery. It signals a weak backup authentication path.
3. Should I enter my real answer here?
No. Enter only estimated length, exposure, and complexity. Never paste actual recovery answers into demos, tickets, documents, or shared tools.
4. How does MFA affect the result?
MFA lowers overall risk because a guessed recovery answer is less likely to become the only barrier protecting account access.
5. Are custom questions always safe?
No. Custom prompts help only when the answer stays private, unique, memorable, and unrelated to public history or predictable personal details.
6. Why is answer reuse penalized?
Reuse lets attackers transfer knowledge between services. Once one site or support desk reveals the answer, other accounts become easier to compromise.
7. Does a longer answer always reduce risk?
Not always. Length helps entropy, but public or obvious answers remain weak. Privacy, uniqueness, and recovery controls matter just as much.
8. What is the safest alternative to security questions?
Use phishing-resistant MFA, recovery codes, hardware keys, trusted-device checks, and verified support procedures instead of knowledge-based prompts.