Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{168531,
        author = {Prof. Anil Haribhau Rokade and Dr. Santosh S. Lomte},
        title = {"An In-Depth Analysis of User Behavior in Graphical Password Schemes: Implications for Security"},
        journal = {International Journal of Innovative Research in Technology},
        year = {2024},
        volume = {11},
        number = {5},
        pages = {1119-1129},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=168531},
        abstract = {Graphical password schemes have emerged as an alternative to traditional text-based passwords, offering a more intuitive and potentially more secure form of user authentication by leveraging the human brain’s natural ability to recall images and patterns. Despite their usability advantages, graphical passwords are still subject to significant vulnerabilities, particularly in relation to user behavior. This research investigates the impact of user behavior on the security and effectiveness of graphical password systems by analyzing how users create, remember, and reuse graphical passwords in three types of schemes: click-based, draw-a-secret, and recognition-based.
The study adopts a mixed-method approach, combining quantitative analysis of user interactions with qualitative feedback through surveys and interviews. A total of 100 participants were tested in a controlled environment, using graphical password systems that mimicked real-world authentication scenarios. Key metrics such as password creation time, recall success rates, and the complexity of passwords were tracked, along with user preferences and feedback regarding the ease of use and perceived security of each scheme.
The results reveal that users tend to prioritize simplicity and memorability over security. In click-based schemes, users often selected visually prominent hotspots, making passwords predictable and vulnerable to guessing attacks. Similarly, in draw-a-secret systems, users favored simple geometric patterns, which significantly reduced the password space and increased the risk of pattern-guessing attacks. Recognition-based systems, while offering higher security due to a larger pool of images, presented usability challenges, as users often struggled to recall unfamiliar or abstract images.
The findings underscore the critical trade-off between usability and security in graphical password systems. While these systems offer improved memorability compared to text-based passwords, user behavior—favoring convenience and simple patterns—compromises their security. The study also highlights the vulnerability of graphical passwords to shoulder surfing, as many graphical systems involve visible interactions that can be easily observed and replicated by attackers.
To enhance the security of graphical password schemes, the research proposes several design improvements. These include randomizing image backgrounds, incorporating complexity requirements for patterns, and providing real-time feedback to users regarding password strength. Additionally, combining graphical elements with text-based passwords in a hybrid authentication system could help balance usability and security.
Future research should focus on further improving the design of graphical password systems, particularly in terms of mitigating shoulder surfing risks and encouraging users to create more complex, unpredictable passwords. Additionally, exploring hybrid authentication methods and evaluating the long-term effectiveness of these systems in real-world environments will be key to enhancing the overall security of graphical password schemes.
This study contributes to the growing body of research on graphical passwords by providing a detailed analysis of user behavior and offering practical recommendations for improving both the security and usability of these systems.},
        keywords = {Graphical passwords, User behaviour, Authentication security, Password memorability, Shoulder surfing, Usability vs. security.},
        month = {October},
        }