Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any academic articles on how people handle their passwords - how many they use in total, how often they change it, whether they commonly store it somewhere or just remember them and so forth?

share|improve this question
up vote 3 down vote accepted

Microsoft Research: A large scale study on password habits

Or google "password user habits" for examples.

share|improve this answer

This is not exactly about password management, it focuses on password creation. I thought that you could find it useful anyway:

share|improve this answer

There is quite a lot of academic work in the area of password selection, prominent papers include:

Yan et al 2000, Kuo et al 2006 and Bonneau and Preibusch 2010

Joseph Bonneau from Cambridge University has done a lot of work in this area including the final paper above and, he is a regular contributor to the Cambridge University Computer Laboratory Security Research blog which is a good source for papers on passwords and proposals for replacing them.

share|improve this answer

The book Security and Usability by Garfinkel and Cranor has relevant chapters from researchers in the field:

  • Chapter 1: Psychological Acceptability Revisited investigates the effort investment that passwords, patching etc require, and how much investment can be requested before people give up and try to subvert the system.
  • Chapter 6: Evaluating Authentication Mechanisms looks at the more general field of investigating the usability of authentication techniques.
  • Chapter 7: The Memorability and Security of Passwords is probably exactly what you want ;-)
  • Chapter 9: Graphical Passwords investigates that alternative.
share|improve this answer

You should probably get a good hash function and you can just store it, on a database. Because a good enough hashed password will tell you no information about your password. Also attempted passwords you can count that, but the other information seems irrelevant imo.

share|improve this answer
The question is more about statistics on how users handle their passwords - how many of them use one password everywhere, how many of them vary it and so forth – ThePiachu May 23 '12 at 5:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.