Projects‎ > ‎Projects Archive‎ > ‎

Visual Passwords

Visual Passwords

Graphical passwords are an authentication mechanism for computer systems. The difference between a VP and the currently dominant alphanumeric password is that with a VP, a user's password is represented by where that user clicks on an image. Thus, an application using graphical passwords for authentication would show a picture to the user. The user would then click in a number of places on the picture, and the coordinates of the clicks would be stored by an application. During authentication, the user has to click on the established points. (The system, of course, allows for configurable error tolerance, since it is not realistic to expect a person to click on exactly the same point each time.)

Graphical passwords attempt to deal with the same problem as do the usual alphanumeric passwords. However, graphical passwords also try to address some drawbacks that are inherent in alphanumeric passwords--hopefully without introducing any drawbacks of their own.

There are some basic requirements that are built into authentication systems based on "what you know." The password should be easy to remember by the legitimate user, but should be hard to guess by everybody else. Unfortunately, those requirements are in conflict. If the password is easy for a user to remember, very likely it is made up of some word and/or some significant number for that user. The word can be either some significant name of a person or place, which can either be found in a dictionary or from basic knowledge about the person, and the same can be said about dates. To summarize, alphanumeric passwords are generally easy to guess. Also, harder passwords or the ones for many different systems are usually written on stickie notes, which makes them less secure.

A graphical password offers a much larger key-space than an alphanumeric one, which is limited to roughly 64 ASCII characters. For example, if we have a 600-by-800 image and an error tolerance of 10 pixels, it would result in 4,800 possibilities. Also, the graphical password is much harder to write down or even tell to some other person. Last but not least, another benefit of graphical passwords is the cued-recall, which helps users to remember a password based on the picture displayed, and not just on memory alone.

From a usability point of view, we conduct experiments to see whether graphical passwords are at least as easy for people to use as alphanumeric passwords. We address both the technical security, which involves the transmission and storage of the password in a secure manner, as well as the user security, which involves an analysis of whether people use the system in a secure or insecure way. The latter is an analysis of how people choose the graphical passwords, and whether they are vulnerable to guessing or dictionary attack.


Emir Dirik
Nasir Memon
Aleksandr Brodskiy

Resources:Graphical Password Homepage

[1] A. E. Dirik, N. Memon, and J.C. Birget, Modeling user choice in the PassPoints graphicalpassword scheme ,Symposium On Usable Privacy and Security, SOUPS, 2007. [BibTex]

[2] J.C. Birget, Dawei Hong, Nasir Memon, Graphical passwords based on robust discretization, IEEE Transactions on Information Forensics and Security, 1(3) (Sept. 2006) 395-399.

[3] S. Wiedenbeck, J. Waters, J.C. Birget, A. Brodskiy, N. Memon, PassPoints: Design and longitudinal evaluation of a graphical password system, International J. of Human-Computer Studies (Special Issue on HCI Research in Privacy and Security), 63 (2005) 102-127.

[4] S. Wiedenbeck, J. Waters, J.C. Birget, A. Brodskiy, N. Memon, Authentication using graphical passwords: Effects of tolerance and image choice, Symposium on Usable Privacy and Security (SOUPS), 6-8 July 2005, at Carnegie-Mellon Univ., Pittsburgh.

[5] S. Wiedenbeck, J. Waters, J.C. Birget, A. Brodskiy, N. Memon, Authentication using graphical passwords: Basic results, Human-Computer Interaction International (HCII 2005), Las Vegas, July 25-27, 2005.

[6] J.C. Birget, Dawei Hong, Nasir Memon, Robust discretization, with an application to graphical passwords, Aug. 2003. (Cryptology ePrint archive,