PassImg: A Secure Password Generation and Management Scheme without Storing

Text password is an important authentication method for computer supported cooperative systems and is usually required to be memorable, strong, and non-reusable. Some password managers can help users manage site-specific passwords locally or on the cloud. However, existing solutions still have a single point of failure risk if the password management scheme is breached. To address the risks identified in current password managers, we proposed a password generation and management scheme called PassImg that can generate consistent passwords through hashing a master password with a user-specified salt image. In this scheme, a weak master password is also allowed while not affecting the security of the scheme. We’ve also proposed a solution for offline parameters synchronization, which would decrease online attack vectors. The user-recognizable image as a parameter can be configured on different devices and synchronized through a QR code. PassImg can ensure password usability and security through an offline managing process without storing any data on the server.