Lessons learned from evaluating eight password nudges in the wild

Karen Renaud, Vera Zimmerman, Joseph Maguire, Steve Draper

Research output: Chapter in Book/Report/Conference proceedingConference contribution

9 Citations (Scopus)
33 Downloads (Pure)


Background. The tension between security and convenience, when creating passwords, is well established. It is a tension that often leads users to create poor passwords. For security designers, three mitigation strategies exist: issuing passwords, mandating minimum strength levels or encouraging better passwords. The first strategy prompts recording, the second reuse, but the third merits further investigation. It seemed promising to explore whether users could be subtly nudged towards stronger passwords.

Aim. The aim of the study was to investigate the influence of visual nudges on self-chosen password length and/or strength.

Method. A university application, enabling students to check course dates and review grades, was used to support two consecutive empirical studies over the course of two academic years. In total, 497 and 776 participants, respectively, were randomly assigned either to a control or an experimental group. Whereas the control group received no intervention, the experimental groups were presented with different visual nudges on the registration page of the web application whenever passwords were created. The experimental groups’ password strengths and lengths were then compared that of the control group.

Results. No impact of the visual nudges could be detected, neither in terms of password strength nor length. The ordinal score metric used to calculate password strength led to a decrease in variance and test power, so that the inability to detect an effect size does not definitively indicate that such an effect does not exist.

Conclusion. We cannot conclude that the nudges had no effect on password strength. It might well be that an actual effect was not detected due to the experimental design choices. Another possible explanation for our result is that password choice is influenced by the user’s task, cognitive budget, goals and pre-existing routines. A simple visual nudge might not have the power to overcome these forces. Our lessons learned therefore recommend the use of a richer password strength quantification measure, and the acknowledgement of the user’s context, in future studies.
Original languageEnglish
Title of host publicationProceedings of LASER 2017
Subtitle of host publicationLearning from Authoritative Security Experiment Results, Arlington, VA, USA, October 18-19, 2017
Place of PublicationBerkeley, CA
PublisherUSENIX Association
Number of pages13
ISBN (Print)9781931971416
Publication statusPublished - 31 Oct 2017
EventThe LASER Workshop: Learning from Authoritative Security Experiment Results - Arlington, United States
Duration: 18 Oct 201719 Oct 2017


WorkshopThe LASER Workshop: Learning from Authoritative Security Experiment Results
Abbreviated titleLASER 2017
Country/TerritoryUnited States
Internet address


Dive into the research topics of 'Lessons learned from evaluating eight password nudges in the wild'. Together they form a unique fingerprint.

Cite this