Is there any research into whether/how people save username/password combinations?

Question

It's something of an open secret that many people don't handle the security of their accounts online in the same way the designers of such systems would want them to. This is why we often see text like "don't re-use passwords", "create a password that's easy to remember but hard to guess", etc. alongside signup forms and forgotten password flows.

What we're looking for is some research into how people work around this nebulous ideal in real life. So for instance, is there any research that discusses:

• How many people write down their passwords on paper or save them in emails?
• How many people share passwords across accounts rather than having unique passwords?
• How many people use password managers instead of trying to do things manually?

I'm looking for research or studies, not guesses.

Answer 1

The two leading standalone password managers are LastPass and 1Password, so much of the info comes from them or deals with them. Also most of it isn't very recent :)

In 2011 LastPass said that a security breach on their service had compromised the data of 1.25 million users.

Also in 2011 Stu Helm, who was associated with 1Password, estimated on Quora that they were into the hundreds of thousands of users.

This infographic from 2012 claims that:

• 73% of people reuse their passwords for some sites
• 33% of people use the same password for every site
• 32% of people save passwords and other login informaiton on a cell phone

Having said that, probably the real most common password managers are those that come as part of the 4 leading browsers, and it's next to impossible to realistically estimate their usage stats.