# Password Managers--It's All about Trust and Transparency
## 1 Introduction  
Passwords continue to be used for authentication in spite of consensus by researchers that we need to have something more user-friendly and secure [1]. A password is considered the most popular method of authentication due to its cost-effectiveness and simplicity [2]. However, people create weak and short passwords, reuse the same password for multiple accounts, write them down and include personal information. Because of human memory limitations, users find it difficult to memorise strong, long and random passwords that are hard to crack [3]. [PERSON] et al. analysed a leaked password data set from a Chinese website and found that passwords contain personal information such as names and dates of birth [4]. Thousands of passwords have been compromised in the last few years because of using personal information in passwords, writing passwords down and reusing the same password for multiple accounts. In response to these problems, a number of tools have been developed to help people handle their passwords, such as random password generators and password managers. [PERSON] et al. state that if a password manager is not used, grouping accounts and reusing passwords become the only manageable solution [5]. So, organizations should consider providing password managers with a built-in generator because people might not create and preserve passwords themselves [6]. In fact, a password manager may be a suitable solution to help people store and manage their own passwords and generate a unique password for each account. [PERSON] et al. state that the low adoption rate for password managers by people might be due to a lack of understanding of the security benefits of these tools [7], because people view them as a security risk [8; 9] or, because of usability drawbacks [9; 10], a lack of trust [11]. So, there is no obvious reason why people do not use password managers even though they are widely available. Existing literature mainly focuses on passwords, but rarely on password managers; therefore, there is no clear answer to the question of low adoption. More to the point, previous work has rarely focused on users of password managers and their perspective. Thus, it is possible that users have similar issues as non-users in terms of trust, security and transparency. Also, to the best of our knowledge, no study has evaluated the user interfaces of password managers, which may be a reason that discourages non-users from using them due to their design and the use of specific functions. The Contribution: Previous studies have predominately focused on passwords or the technical side of password managers [3; 12; 13; 14; 15] conducted general studies on password managers [9] or smartphone password managers [16; 17], but rarely on the human perspective and user interface of password managers and types of password managers that are used. This paper looks at the user interface and usability of three cloud password managers using [PERSON]'s principles. Also, it looks at the human perspective regarding the use and non-use of password managers in regard to four key aspects--usability, trust, transparency and security--using an interview study and an online questionnaire study. This paper adds to the existing literature on the analysis of password managers using mixed methods to understand the obstacles to the adoption of password managers on the one hand, and the views of users of password managers on the other. In this paper, both expert and non-expert participants are compared in several aspects, such as password reuse and the use and non-use of password managers. Finally, this paper reports users' views on aspects such as trusting vendors, storing passwords, using random password generators and types of password managers that are used the most. A previous study [18] only considered people with an educational background in information security as experts, or people that had many years of experience in this field [7].