Why the number isn't the point
The score out of 100 is a rough signal, not a measurement — six self-assessed questions can't capture everything about how exposed you actually are, and the point bands are deliberately worded as "Some gaps" or "High-priority gaps" rather than anything that sounds like a certification. What's more useful is the follow-up: this quiz identifies whichever question (or questions — see below) came out weakest relative to their own maximum, and points at one concrete thing to do about specifically that gap, rather than a generic "improve your security" non-answer. Where none of our own tools actually address a gap (how you handle public Wi-Fi, whether you'd catch a phishing attempt, whether your device still gets updates), the suggestion is plain advice instead of a forced link.
How the scoring works
Each question is worth a fixed number of points toward a 100-point total (20 each for password reuse, two-factor authentication, and password manager/passkey adoption; 15 each for device updates and public Wi-Fi habits; 10 for recognizing a phishing attempt) — weighted roughly by how much each habit tends to matter in practice, not by any rigorous risk model. Two questions were deliberately kept separate rather than combined: whether your passwords are actually unique (question 1) and whether you use a tool built for that (question 3) are related but distinct facts — someone can have unique passwords without a manager, or a manager they haven't fully migrated to yet, so asking both avoids one overly broad question standing in for two different things. Some questions also offer more than one way to score full marks — avoiding public Wi-Fi entirely and using a trusted VPN carefully are both treated as equally good, for example, since the goal is the outcome (not being exposed on an untrusted network), not one specific method. Using a VPN is worth a qualifier, though: modern HTTPS already encrypts the contents of most of what you send to websites, so a VPN is an additional layer on top of that. A trusted VPN can hide destination information (which sites you're visiting) from the local network and your internet provider — but it shifts that visibility to the VPN provider instead of eliminating it, so it's an additional layer, not a complete guarantee, especially if certificate warnings get ignored or file sharing is left on. If two or more questions tie for your weakest area, the quiz says so explicitly and addresses all of them, rather than silently picking one and implying the others are fine.
Frequently asked questions
Is this quiz storing or scoring my answers on a server somewhere?
No — every answer is processed locally with plain JavaScript, and this quiz doesn't write anything to browser storage on its own. Note that some browsers can temporarily restore filled-in form fields when you navigate back or reopen a tab (session restore, back-forward cache) — that's a browser feature working on any form, not something this page does intentionally.
I got a good result but still feel unsure about my security. Is that normal?
Yes. A strong result here means your answers to six specific questions were good — it doesn't mean you're immune to every kind of attack. Treat it as a starting point for what to look at first, not a final verdict.
Why did it flag more than one weak area?
Because that's what the numbers actually showed. If two questions tie for your lowest score relative to their maximum, picking just one to report would misleadingly suggest the other is fine — the quiz lists every area tied for weakest instead.
Where do the suggestion links go?
When a matching tool exists on this site, the suggestion links to it. For gaps none of our tools actually address (phishing recognition, public Wi-Fi habits, device updates), the suggestion is plain advice with no link at all, rather than a link chosen just to have one.
Last reviewed: . Methodology: 6 fixed-weight questions scored locally; ties for the weakest-scoring question (as a fraction of its own maximum) are reported together rather than resolved arbitrarily.