What we found

We set out to build a better engine for simulating investment returns, and found that the engine barely mattered. What mattered was UK tax law, the State Pension, and one decision about tax-free cash that moves the answer further than any other choice on this page.

Along the way the most famous number in retirement planning fell over. That seems the right place to start.

1The 4% rule is a fact about American data

The rule is familiar even to people who have never read where it came from: a retiree takes 4% of the pot in the first year, increases that amount with inflation every year after, and the money is said to last thirty years.

It comes from a 1994 paper by the American financial planner William Bengen. He took US market data going back to 1926, put a portfolio half in shares and half in bonds, and worked out what withdrawal rate would have survived every thirty-year window in that history. The answer was about 4%. His words: “In no past case has it caused a portfolio to be exhausted before 33 years.”

That is a real result, carefully done. But look at what it is a statement about. It is a count of overlapping windows drawn from one country's market history. It is not a probability. There is no sense in which it says “this works 100% of the time” — it says “this happened to work in every stretch of American history we have data for”.

Which raises an obvious question, and someone has answered it.

The same test, run on seventeen countries

In 2010 Wade Pfau ran Bengen's exercise across 17 developed countries using the Dimson–Marsh–Staunton dataset, covering 1900 to 2008. He allowed each country the best possible asset allocation with a century of hindsight, which is generous in a way no real retiree could be.

Four countries out of seventeen reached 4%. The United States was the fourth of them, and only just. A British retiree, drawing on British market history, would have got 3.77%. At a full 4%, the worst British starting year — 1900 — ran dry after 26 years.

What our own engine says

We tested the same withdrawal against a simulated market that compounds at 4.09% a year after inflation, with 16.5% volatility. A 4% draw survived thirty years in 74% of runs.

We want to be careful about what that does and does not show. It is not a replication of Bengen: our series is more volatile than his half-bonds portfolio and it is synthetic rather than historical, and both of those push the number down. It is a demonstration of something narrower and, we think, more useful — that the relationship between the draw rate and the rate the money actually compounds at is very nearly the whole story. A 4.00% draw from something growing at 4.09% is a close-run thing. The 100% was never a property of the number 4. It was a property of the data.

And all of that is before a penny of tax. Which is where the rest of this page comes in, because Bengen's American retiree was not navigating the UK personal allowance taper.

2“A 5% return” is not yet a number

Ask what a 5% expected return means and there are two answers. They are not close, and almost nothing tells you which one is meant.

If 5% is the geometric mean — the rate the money actually compounded at, year after year — then volatility around it does not much hurt the middle outcome, and can help it.

If 5% is the arithmetic mean — the simple average of the yearly returns — then volatility eats into it, and the more volatile the series the more it eats. This is not an obscure effect. Push volatility to 25% and a stated 2.94% real return compounds at −0.23%. The number on the page has not changed. The money is gone.

The FCA's projection rates in COBS 13 Annex 2 are maximum rates set for a single-path, deterministic projection: a rate compounded annually, with no distribution around it. Nothing in the rules says what to do with that number inside a stochastic model, and the arithmetic/geometric distinction is never addressed there because within a single path it never arises. As far as we can tell, no consumer calculator addresses it either: they take a percentage and run. This tool makes the choice explicit, because the choosing is the modelling.

3The decisions that move the answer are not the ones people model

We ranked modelling choices by how far each one moves a single number: the share of runs in which a £500,000 pot delivers £30,000 of income after tax from age 60 to 95. That is the scenario the calculator loads with: averaged over three random seeds it funds the full income in 35.7% of runs, and the single seed the front page uses reports 35%.

The last row is a matched pair rather than a change to the baseline: the same scenario run through a historical-style block bootstrap and through an independent lognormal draw, both set to the same 4.09% real return and 16.5% volatility, scored 46.0% and 48.8%.

That last row is the punchline. The return-generating engine — the part that looks like the hard modelling, the part with the interesting mathematics — is worth about a ninth of what happens to the tax-free cash.

We expected the opposite. The idea going in was that realistic market structure, with bad years clustering into bad decades, would separate a sophisticated engine from a naive one. It doesn't, and the reason is that daily turbulence largely washes out once it is compounded into annual returns. Matched on return and volatility, the two engines never disagreed by more than about three points anywhere on the withdrawal curve.

Three of the seven rows are specific to UK policy: the band freeze, the National Insurance record, and the treatment of the lump sum. We are not aware of a free calculator that models any of them.

4The tax-free cash decision is the largest single choice on the page

A quarter of a pension pot can usually be taken free of income tax, subject to a lump sum allowance of £268,275. What happens to it next is, on these numbers, the largest single choice on this page — larger than the return assumption, larger than retiring two years later, and close to nine times the choice of simulation engine. (The household comparison in §5 is larger still, but nobody chooses their household.)

The mechanism is not complicated. In the model, a pound of retained lump sum displaces £1.25 of gross withdrawal at a 20% marginal rate and £1.67 at 40%, because it arrives without income tax attached. Spend it elsewhere and the taxable pot has to cover the whole income, at the taxpayer's marginal rate, for thirty-five years.

We are not saying what anyone should do with it — there are perfectly ordinary reasons to take the cash and use it, and this model knows nothing about anyone's circumstances. We are saying that if a projection does not ask the question, its answer is missing the largest term.

5Two of everything

Same £800,000, same £40,000 net target, same ages. The only difference is whether it sits in one name or two.

Nearly double the success rate and £94,000 less tax on the same delivered income, from nothing but having two of everything the tax system grants per person: two personal allowances, two basic-rate bands, two State Pensions.

The comparison has to be made on runs that delivered the income, because otherwise it flatters the wrong household. Across all runs the single person's median lifetime tax is only £181,200 — lower, but only because the median single-person run stops being able to withdraw at 83. Running out of money is an effective way to reduce a tax bill and a poor way to fund a retirement. We found this the hard way; §7 has the story.

Nobody can act on this — a household is not a setting. It is here because it calibrates the rest. An effect of 37 points makes the 12 points from the return assumption look modest, and makes the 3 points from engine choice look like what it is.

And the survivor cliff is the opposite of what people expect

The intuition is that losing a partner is a catastrophe for the pot. It isn't — because the survivor spends about a third less. What actually happens is quieter and worse.

Spending falls 33%. The withdrawal falls 4%.

The survivor loses one State Pension — £12,547.60 a year, which at the full new State Pension with no protected payment is not inheritable — and one personal allowance, £12,570 of tax-free room. Both vanish at once, and the pot has to replace them. So it drains for one person very nearly as fast as it did for two.

The cliff is real. It is a cliff in how efficiently income is produced, not in whether the pot survives. A model that reports only a success rate will show almost nothing happening. This one reports both.

6A bug in how this is usually built

GOV.UK presents income tax as ranges: £12,571 to £50,270 at 20%, and so on. That presentation quietly assumes a full personal allowance.

The legislation works differently. The basic-rate band is a width — £37,700 — that sits on top of whatever personal allowance survives the taper that begins at £100,000 of income. Once the allowance starts disappearing, the 40% band starts lower, not at £50,270.

Build a calculator from the published table rather than from the legislation and you understate the tax across the whole taper region. The gap widens as the allowance vanishes, reaching £5,028 a year — 40% of the lost allowance — the moment the allowance is gone at £125,140 of income, and staying there for every income above that. That is precisely the range a large pot in drawdown reaches when someone takes a big withdrawal.

Our first implementation had this bug. The engine now reproduces figures computed from the legislated rates exactly — £33,432 of tax on £110,000, £53,703 on £150,000 — and those two checks run every time the test suite runs.

Worth noting what kind of mistake it was: not an error in the mathematics, but an error in reading a government website correctly. Those are the ones that survive review.

7Two bugs in ours, and what they cost

The one the tests should have caught

In August 2026 we found that our Python engine handed a household £100,000 of tax-free cash out of the pot of a partner who was already dead when the projection began. A deceased member's lump sum entitlement dies with them; the pot passes across whole. Nobody could ever have taken that money.

On a £400,000 + £400,000 household with a £40,000 target and a partner dead at the start, the success rate was 90.1% before the fix and 88.1% after. Two points, in the flattering direction — just under the engine-choice effect in §3 that we use as the threshold for whether a feature is worth building at all.

The interesting part is why it survived. There are two independent implementations here, the JavaScript in your browser and a Python reference, and a script that cross-checks them against each other. The JavaScript had the guard. The Python did not. The cross-check should have caught it instantly — except that every couple test case passed a death age of zero. The comparison had never once exercised a death.

The fix and the tests that pin it are in the repository. We checked that the new tests fail when the guard is removed, because a test that cannot fail proves nothing. One of them is deliberately run at zero volatility, so the error shows up as a flat £100,000 discrepancy in the opening balance rather than as a statistical wobble a different random seed might have hidden.

The one we found writing this page

Checking the numbers for §5 turned up a second one, of exactly the same shape.

Lifetime tax was accruing on the withdrawal a household intended to make, not on the withdrawal its pot could actually fund. Once a pot ran dry the model went on charging tax to 95 on money nobody withdrew. The symptom, once we looked, was unmistakable: across 20,000 runs the lifetime tax figure took exactly one value. A run that failed at 83 and a run that paid out in full to 95 reported the same tax bill, and the number did not move when the returns did.

It survived for the same reason the first one did: nothing compared it. The browser engine does not compute lifetime tax at all, so the cross-check between the two engines had nothing to check it against. An output that only one implementation produces is an output no one is checking.

What it changed: the headline in §5 held up, because that comparison is made on runs that delivered the income in full, and on those runs the old figure was right. What was wrong was everything that depended on the spread — the claim that £111,450 was a median, and any comparison across runs that failed. The tax difference between one household and two moved from £94,275 to £94,260, which is to say it did not really move at all. The distribution behind it went from a single point to something with a shape.

The new checks in verify_household.py pin two things: that lifetime tax varies across paths at all, and that a run which ran out of money never reports more tax than one which funded the income in full. We removed each guard in turn to confirm the checks fail without it. The second check is the load-bearing one — the first can be satisfied by an engine that is still wrong.

8What isn't modelled

Being explicit about this matters more than the feature list.

• Inherited pots are treated as fully taxable drawdown. The real rules differ by age at death — broadly tax-free if the member died before 75, taxed at the beneficiary's marginal rate after. Ours is the cautious direction. It is a disclosed simplification, not an error.
• Only a partner's death is modelled, not your own.
• Both pots in a couple share one return path. One household, one market — no diversification benefit between partners. Again the cautious direction, and stated on the page rather than buried.
• No National Insurance (correct for pension income, wrong the moment earned income is added), no money purchase annual allowance, no defined benefit pensions or annuities, no inheritance tax, no investment charges, no care costs, and no ISAs or other wrappers yet.
• Mortality is a date you pick, not a probability.
• The State Pension defaults to the full new State Pension, which assumes a complete National Insurance record. Many people get less. An actual forecast is at gov.uk/check-state-pension.

9How to check any of this

Every figure on this page comes out of code that anyone can run.

git clone https://github.com/kdownie/uk-pension-stress-test
cd uk-pension-stress-test/engine
pip install -r requirements.txt
python verify.py && python verify_household.py && python verify_web.py

• verify.py — tax against figures computed from the legislated rates, the gross-up as an exact inverse of the tax function, the simulator against a closed-form answer at zero volatility, and the 4% result in §1.
• verify_household.py — Scottish bands hand-computed from the band table, couples, and the tax-optimal split checked against a brute-force search.
• verify_web.py — drives the actual live page in a headless browser and compares what the browser computes to what Python computes, line by line.

Every legislated figure lives in one block in engine/uk_rules.py with a source URL and the date it was checked. If a number is not there with a source, it is not used.

Monte Carlo figures move by a few tenths of a point between random seeds, so every simulated figure here is averaged over three seeds and quoted to one decimal place. The longer technical version of this page is docs/FINDINGS.md in the repository.

Sources

W. P. Bengen, “Determining Withdrawal Rates Using Historical Data”, Journal of Financial Planning, October 1994 — paper (PDF).
W. D. Pfau, “An International Perspective on Safe Withdrawal Rates: The Demise of the 4 Percent Rule?”, Journal of Financial Planning, December 2010 — paper (PDF).
Projection rates: FCA Handbook COBS 13 Annex 2 — handbook.fca.org.uk.
Tax and State Pension figures: gov.uk/income-tax-rates, gov.uk/new-state-pension.