# Improving Users' Passwords with DPAR: a Data-driven Password Recommendation System

**Authors:** Assaf Morag, Liron David, Eran Toch, Avishai Wool  
**arXiv:** [2406.03423](https://arxiv.org/abs/2406.03423)  
**Date:** 2024-06-05  
**Summary page:** https://www.summarizepaper.com/en/paper/2406.03423v1/

## Key points

- In the digital age, passwords serve as the primary means of authentication for online accounts.
- Users often struggle to create strong yet memorable passwords despite password policies and meters.
- A team of researchers led by Assaf Morag, Liron David, Eran Toch, and Avishai Wool developed DPAR: a Data-driven Password Recommendation system.
- DPAR leverages a dataset of 905 million leaked passwords to generate personalized password recommendations.
- DPAR suggests modifications to enhance password strength while maintaining memorability and similarity to the original password.
- Two studies verified the effectiveness of DPAR in improving password strength and recall compared to traditional password meters.
- DPAR significantly increased password strength by an average of 34.8 bits without compromising users' ability to recall their passwords.
- 36.6% of users accepted DPAR's recommendations without any modifications.
- The research highlights the potential impact of data-driven approaches in enhancing password management practices.
- By offering tailored suggestions for creating stronger yet memorable passwords, DPAR improves user experiences in navigating online authentication processes.

## Summary

In the digital age,  serve as the primary means of  for online accounts. Despite efforts to implement password policies and meters, users often struggle to create strong yet memorable passwords. To address this issue, a team of researchers led by Assaf Morag, Liron David, Eran Toch, and Avishai Wool have developed <kd> DPAR: a Data-driven Password Recommendation system. This innovative system leverages a vast dataset comprising 905 million leaked passwords to generate personalized password recommendations. DPAR operates by analyzing a user's existing password and suggesting specific modifications that would enhance its strength while maintaining memorability and similarity to the original password. The effectiveness of DPAR was evaluated through two comprehensive studies. The first study focused on verifying the memorability of generated passwords among 317 participants, while the second study assessed the strength and recall of DPAR recommendations compared to traditional password meters with a sample size of 441 individuals. The results of these studies were promising, demonstrating that DPAR significantly increased password strength by an average of 34.8 bits without compromising users' ability to recall their passwords. Moreover, an impressive 36.6% of users accepted DPAR's recommendations without any modifications. These findings underscore the potential impact of  approaches in enhancing password management practices. Overall, the research conducted by Morag et al. sheds light on the efficacy of utilizing large-scale datasets to inform password recommendation systems like DPAR. By offering tailored suggestions for creating stronger yet memorable passwords, DPAR represents a valuable tool in bolstering  measures and improving user experiences in navigating online authentication processes. The authors' work not only contributes to advancing password security practices but also highlights the importance of incorporating  insights into  solutions for optimal outcomes in today's digital landscape.