Comparing a Store-less Password Manager with Traditional Password-Only Authentication

About this work

Abstract

This study evaluates the usability and user perception of HIPPO, a store-less password manager that dynamically derives site-specific passwords rather than storing them in a conventional vault, against traditional password-only authentication. Twenty-five participants completed installation, configuration, password-update, and login tasks using both approaches. HIPPO introduced some additional interaction for password generation and entry, but participants generally viewed it as more secure and trustworthy and reported favorable usability and satisfaction. The study highlights the practical trade-offs between reducing password-storage risk and maintaining a simple authentication experience, and offers guidance for designing secure password-management tools that users are willing to adopt.