# Age and Gender Impact on Password Hygiene
## 5 Conclusions and Future Work  
Based on the analysis of over 100,000 passwords recovered from a high-quality leaked database, we determined that persons above 45 years old have the weakest passwords, and the strength decreases with age. One reason may be the lack of exposure to IT during their youth, although the exact reasons are left for further research. Although the effect size was small, females had significantly weaker passwords than males for all age groups. In general, the users' password hygiene could be considered very weak. Passwords of around 40% of users were found in previously leaked databases, including the old Rockyou dictionary.  
Several additional conclusions arise from the analysed data. Firstly, users could be encouraged to use their entire national alphabet whenever possible--the introduction of special letters (a, c, n, o) considerably improves password strength. Nevertheless, words or word fragments must be avoided at all costs, no matter their language, spelling, or mangling. It is important to check newly generated passwords against collections of previously leaked passwords.  
The strength of the hashing algorithm has little influence on the security of the hashed password because over 70% of user passwords are vulnerable to dictionary attacks. Neither the gender nor age of the user changes the statistics significantly. It might be impossible to persuade every person to use password managers and unique randomly generated passwords for every different application. Hence, the responsibility for password security mainly falls to service providers who should implement password strength meters and enforce password policies. The suggestion to force users to choose stronger passwords via specific means implemented by system developers has been raised before, as simple visual nudges do not influence them to choose longer or stronger passwords [37]. However, our results show that password alone is no longer a viable option, and the only reasonable alternative is multi-factor authentication.  
The future directions of the work would be to investigate the development, usage, and policies on password enforcement mechanisms. The qualitative research of selected systems would provide insights into the user behavioural patterns from psychological and educational perspectives. Another possible direction is to research the impact of multi-factor authentication systems on future password complexity and develop methods to encourage more complex passwords. Finally, future research should delve into the underlying causes of the observed insecure user behaviour. In particular, trust in the technology and implications of trust to the complexity of passwords could be explored from the perspective of different age groups and genders.  
Conceptualization, A.J. and A.B.; methodology, A.J., L.B.; software, A.J.; validation, A.J., L.B., R.G.L.; formal analysis, A.J., L.B.; investigation, A.J., L.B., R.G.L.; resources, A.J.; data curation, A.J.; writing--original draft preparation, A.J., A.B., L.B., R.G.L.; writing--review and editing, A.J., A.B., L.B., R.G.L.; visualization, A.J., R.G.L. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Not applicable.  
[PERSON] would like to acknowledge [PERSON] for his assistance during the password recovery.  
The authors declare no conflict of interest.  
Samples of the aggregated research data are available from the authors.