There are lots of ad-hoc rules that people are happy to propose about passwords, such as:

  • Pick a phrase you can remember easily, and then use the initial letters.
  • A random short sequence of letters, numbers and symbols.
  • A sequence of random common words (like XKCD's "battery correct horse staple").

There is also a pile of computer security research on what passwords are hard to crack.

It seems like a pretty simple empirical question to say what is the best password scheme for any given desired strength.

Can anyone point me to any research about the ease of memorizing passwords generated according to various rules?

  • 1
    $\begingroup$ One study is Yan, J., Blackwell, A., Anderson, R. & Grant, A. (2004). Password memorability and security: Empirical results. Security & Privacy, IEEE, 2, 25-31. PDF $\endgroup$ Oct 8 '12 at 11:43
  • $\begingroup$ Consider yourself pointed scholar.google.com/scholar?q=+Password+memorability $\endgroup$
    – Jeff
    Nov 11 '12 at 8:42

It looks like there is some empirical evidence that passphrases are easier to remember than either random passwords (not surprising) or user-selected short passwords after standard advice to use mix of upper and lower and avoid words.


Thanks Jeff for the pointer in a comment (same Jeff?).

J. Yan, A. Blackwell, R. Anderson and A. Grant. The memorability and security of passwords -- some empirical results. University of Cambridge, Computer Laboratory Technical Report No. 500, 2000. (see also Hungarian translation). PDF

J. Yan, A. Blackwell, R. Anderson and A. Grant. Password Memorability and Security: Empirical Results. IEEE Security & Privacy, Vol. 2 No. 5, 2004. PDF

the above is reprinted as:

J. Yan, A. Blackwell, R. Anderson and A. Grant. The Memorability and Security of Passwords. Refereed book chapter in Security and Usability: Designing Secure Systems that People Can Use (ed. by Lorrie Cranor and Simson Garfinkel), OReilly & Associates, USA, 2005.

  • $\begingroup$ hah, definitely not the same Jeff! interesting studies; i've edited to include the citations directly $\endgroup$
    – Jeff
    Nov 16 '12 at 0:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.