Memorability of Alternative Password Systems

Abstract

Randomly generated alphanumeric passwords are widely used to restrict access to computer networks but are readily forgotten, resulting in costs to both organizations and users. In order to address this, there is a need to develop and evaluate new forms of memorable passwords. Drawing on memory research and the importance of meaning, the efficacy of three alternative "password" systems having varying degrees of personal meaning were compared with the more traditional but personally meaningless randomly generated alphanumeric passwords. Twenty experienced computer users self-generated four-string variable passwords based on alphanumerics, symbols of personal meaning and faces. Additionally, participants were assigned a meaningless, randomly generated four-character alphanumeric password. Password memorability was measured in terms of acquisition (number of trials/time to criterion), retention (from forgetting functions) and retrieval (time to recall/recognize the passwords). Meaning was found to assist memorability and a mediating effect of familiarity was also observed. Contrary to expectation, self-generated, meaningful symbol-based passwords were not the best remembered of the password types studied but may still be a viable overall alternative.