Studies show that people generally choose poor passwords.
Several references suggest that there is a 99 percent chance of successfully guessing at least one password on a system containing as few as 16 accounts. These problems are especially evident when users have full freedom to chose their passwords and do not have sufficient guidelines or are limited by rules about minimum length, choice of characters, and duration of password validity. The growth of the Web has added to the problem as an increasing number of sites require free username and password registration. Emerging cryptographic protocols may not help as much as we think, either. Cryptographic mechanisms are not intended primarily for security, per se, but for authentication, privacy, and data integrity.