Are there any good guidelines to how many passwords a user can safely remember?

Question

In an ideal world we each would have one password to remember, and that would be a strong password and we would change it every month or so. But we don't live in an ideal world, and we have to access many sites with many login prompts, and good security practice recommends that each password be different.

Can you find/site any good studies showing how many passwords (of varying complexity) an average human can effectively remember and use?

Last time I counted I had 28 different passwords required just for my direct job responsibilities (I am not including any off-time browsing for my own amusement.) What definite things can we say about the usability of this? The company recently sent around a "security guideline" that states that no password should ever be written down, nor should any password be shorter than 16 letters, they all must be unique, and we should change them every quarter. That is good in principle, but impossible in practice. The guidelines seems to have been written with the idea that each worker will have only one password.

Are there any serious usability studies that would support this as being unrealistic? If so, what is the reasonable maximum number of passwords that a worker should be required to remember?

When you overburden a user, you run several risks. At some number of passwords, users run the risk of forgetting which password to use. What is that level? Then, what is the tradeoff between writing the password down vs. using the same password at multiple sites? Does anyone know of any good studies of this?

Let me head off any discussion of password managers. I have had some good luck with one of those recently, but the company requirements specifically state that you are not allowed to use a password manager or anything else that would store the password. Clearly I want to suggest using such a manager, but I need good supporting evidence. So please don't simply say that a password manager is a good solution.

Answer 1

A company I work for recently had a speaker come and talk about this topic in particular. She is a PHD so she does a lot of research on Passwords and Security... She mentioned in her talk that the human brain can really only remember three words at a time, something like that.

The conclusion for me was: until every website that requires a password implements better security practices (like multifactor authentication) nothing is really secure...

In any case, remembering more than a handful passwords is unrealistic. My company is actually trying to implement a password manager for all employees.

I don't necessarily like that, but there are many reasons this is a secure way to store passwords, among them: Decrypting retrieved passwords locally, leading encryption algorithms (make your passwords more secure), and multifactor authentication.

That's all great, but I have developed my own way of not having to remember my (100+ ?) passwords, I came up with a method which allows me to figure them out on the spot:

1. I have come up with a beginning and an ending pattern to all of my passwords. I have a few patterns I use for different types of logins. It's a short pattern I can easily remember but it is not a real word.

2. I have come up with symbols to substitute certain letters when they appear in my passwords (such as “A” replaced by “4” for example, that’s a straight forward example which I am not using…)

3. I have come up with a “sentence structure” for all of my passwords depending on what the login is for. Not something simple like “mybankaccount123” of course, but the idea is similar. It is very personal to me so I doubt anyone would figure it out.

Once I came up with this cheat sheet I was able to figure out my own passwords, but they are still all very secure (contain “non-words”, numbers, upper case, lower case, symbols and even real words)

And I never use the same password twice.