Study shows emojis in passwords secure and more fun, too

Would you rather unlock your smartphone with a plain four-digit PIN or with a smiley-face emoji?

Smartphone users commonly use emojis to express moods, emotions and nuances in emails and text messages.

To learn more, a team of researchers from the Technical University Berlin, Ulm University and University of Michigan, led by TU Berlin Ph.D. candidate Lydia Kraus, developed EmojiAuth, an emoji-based login system for Android smartphones.

Most smartphone users keep their screens locked and need to unlock them numerous times a day. Many people use numerical PINs, but research tells us that images are easier to memorize and recall than numbers or letters. PINs can also only be composed from a small number of symbols: the numbers 0 to 9. Passwords can be created from a larger set of characters but are difficult to type on smartphones. Using emojis allows users to draw from over 2,500 emojis, which promises passcodes that are more resistant to cracking and casual observation.

In the experiment, 53 participants were given an Android phone and divided into two groups. The first group of 27 people selected a passcode made up of any of 12 emojis on an emoji keyboard individually generated for each user from the library of all possible emoji icons. The remaining 26 people picked a numeric PIN.

Results showed both PINs and emoji passcodes were very memorable. Overall, PIN users remembered their passwords slightly more often. But people who used emoji passcodes reported having more fun entering their codes.

The security of emoji passcodes was also tested. Participants were asked to “shoulder surf,” peeking over the researcher’s shoulder while she entered a passcode.

Emoji passcodes consisting of six randomly selected emojis were hardest to steal.