The Impact of Gender on Password Security

ZOU Yunkai; WANG Ding

doi:10.11999/JEIT261036

Article Contents

Article Navigation > Journal of Electronics & Information Technology > 2026 >

ZOU Yunkai, WANG Ding. The Impact of Gender on Password Security[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT261036

Citation:

ZOU Yunkai, WANG Ding. The Impact of Gender on Password Security[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT261036

ZOU Yunkai, WANG Ding. The Impact of Gender on Password Security[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT261036

Citation:

ZOU Yunkai, WANG Ding. The Impact of Gender on Password Security[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT261036

PDF( 1874 KB)

The Impact of Gender on Password Security

doi: 10.11999/JEIT261036 cstr: 32379.14.JEIT261036

ZOU Yunkai,
WANG Ding^,

1.
College of Cryptology and Cyber Science, Nankai University, Tianjin 300350, China
2.
Tianjin Key Laboratory of Network and Data Security Technology, Nankai University, Tianjin 300350, China
3.
Key Laboratory of Data and Intelligent System Security, Ministry of Education, Tianjin 300350, China

Funds: The National Natural Science Foundation of China (62502238 and 62572259), The China Postdoctoral Science Foundation under Grant (2025M771596), The Tianjin Natural Science Foundation Project (25JCJQJC00230)

Received Date: 2026-07-27
Accepted Date: 2026-11-05
Rev Recd Date: 2026-09-23

Available Online: 2026-11-14

Abstract

Abstract

Objective Passwords are short, human-memorable secrets widely used in identity authentication and cryptographic applications. Existing research has largely focused on explicit personally identifiable information (PII), such as names and birthdays, whereas the relationship between implicit PII, particularly gender, and password construction remains insufficiently understood. This study examines gender-related differences in password characteristics and cross-site reuse behaviors, and evaluates whether incorporating gender information improves password guessing. Methods The study uses approximately 35.51 million real-world password records from eight websites, comprising four Chinese and four English services (Table 1). Gender-related analyses are based on records with directly available or email-linked gender information. Password characteristics are analyzed along seven dimensions: frequency distribution, length, PII usage, popularity, character composition, structure, and semantics. Parameters of the cumulative distribution function-based Zipf (CDF-Zipf) model are estimated by comparing empirical rank-based cumulative frequency curves with those obtained from simulated samples of the same size. Each fitted model is evaluated using 30 independent simulations. Equal-size sampling within website-by-gender strata balances website contributions to pooled comparisons. Email-linked password pairs associated with Promo and Zoosk are analyzed using normalization rules, edit distance, content overlap, and character-type structures. A gender-conditioned likelihood-ratio framework is developed to rerank existing guesses. For the probabilistic context-free grammar (PCFG) model, structural prior probabilities are calibrated while character-segment probabilities remain unchanged. Sharing segment dictionaries preserves information from pooled training data and helps mitigate the sparsity associated with training separate generative models for each gender. G-TarGuess-II augments TarGuess-II with gender-conditioned lexical features derived from complete passwords, case-normalized forms, initial and final character blocks, and character n-grams. For each account, the same 100 baseline guesses are reranked. Evaluation focuses on pairs with different known and target passwords (at 10 guesses per account). Password-pair datasets are partitioned by email identifier, parameters are selected using validation data, and paired guessing outcomes are assessed using two-sided exact McNemar tests with Holm correction. Sensitivity analyses examine simulated email mismatches and gender-label perturbations. Results and Discussions Across websites, Jaccard similarities between male and female users’ password sets range from 0.86% to 4.85% (Table 2). Despite this limited overlap, both groups show similarly skewed, long-tailed frequency distributions, well characterized by CDF-Zipf models with gender-specific exponent estimates differing by at most 0.052 within each website (Fig. 1). For each of the 16 gender-specific subsets, the maximum absolute discrepancy between the empirical and simulated cumulative frequency curves is averaged over 30 simulations. These averages range from 0.29 to 2.62 percentage points, with an overall mean of 0.98 percentage points. Passwords longer than 10 characters are more prevalent among female users in the Chinese datasets, whereas the proportions are slightly higher among male users in the English datasets (Table 3). Passwords containing at least one PII type account for 34.82%-51.36% of passwords in the four Chinese datasets and approximately 20% in ClixSense and QNB. PII match rates are higher among male users in 12306, Dodonew, and CSDN, whereas WuxiHR shows the opposite trend (Table 4). In the balanced structural comparison, digits constitute more than half of the characters in 48.26% of male users’ passwords and 43.90% of female users’ passwords (Table 6). In the balanced English-language samples, 17.16% of female users’ passwords and 11.92% of male users’ passwords contain terms from at least one predefined semantic category (Table 7). Among users whose passwords matched at least one predefined semantic category, female users were more likely to use passwords containing terms from the relationship and identity categories, whereas male users were more likely to use passwords containing terms from the emotion and interest categories (Table 7). In both email-linked password-pair datasets, male users’ pairs show higher rates of local similarity and content overlap, whereas female users’ pairs more frequently share the same character-type sequence and segment lengths (Tables 10 and 11). At 10⁴ guesses, gender-conditioned PCFG improves guessing success rates across eight websites, with relative improvements of 2.86%-9.09%, averaging 5.17% (Table 13). The newly guessed passwords in CSDN and WuxiHR were predominantly eight-digit and six-digit numeric strings, respectively (94.12% and 80.00%), whereas alphabetic strings accounted for 89.66% of the additional passwords successfully guessed for female users in ClixSense and Promo combined. Pooled relative improvements across websites are 3.36% for male users and 6.80% for female users; both are statistically significant after Holm correction. At 10 guesses per account, G-TarGuess-II achieves relative improvements of 3.54% on Promo and 8.91% on Zoosk for female users. These improvements are statistically significant, whereas the corresponding gains of 0.20% and 0.72% for male users are not (Table 14). Additional successful guesses arise from moving correct guesses from baseline ranks 11–100 into the top 10, without increasing dictionary size. Among the additional passwords successfully guessed for female users, 91.57% are formed by appending a single digit to the known password. Reversing the roles of the known and target passwords preserves positive overall gains and larger relative improvements for female users. Simulated email mismatches and gender-label perturbations generally preserve the directions of the principal descriptive differences, although their magnitudes may decrease. Conclusions Gender information can improve password guessing by reranking existing guesses. The gains depend on language, service context, the baseline model, and the allowed guess number. These findings support using gender as an auxiliary factor in password security evaluation, but do not indicate that either gender consistently chooses stronger passwords. Practical defenses should address the use of personal information and simple modifications of existing passwords while limiting the collection of sensitive user attributes. Future work could combine user studies with analyses of more diverse datasets to investigate motivations behind password construction and reuse, and assess the generalizability of the observed gender-related differences.
- Password security,
- Implicit personal information,
- Password reuse,
- Gender differences

FullText(HTML)

References(56)

References

[1]	BONNEAU J, HERLEY C, VAN OORSCHOT P C, et al. Passwords and the evolution of imperfect authentication[J]. Communications of the ACM, 2015, 58(7): 78–87. doi: 10.1145/2699390.
[2]	HA Guanxiong, JIA Chunfu, GE Xiaowei, et al. Efficient and anonymous password-hardened encryption services[J]. Information Sciences, 2024, 653: 119771. doi: 10.1016/j.ins.2023.119771.
[3]	DZIEMBOWSKI S, JARECKI S, KEDZIOR P, et al. Password-protected threshold signatures[C]. 30th International Conference on the Theory and Application of Cryptology and Information Security, Kolkata, India, 2024: 174–206. doi: 10.1007/978-981-96-0891-1_6.
[4]	舒琴, 王圣宝, 路凡义, 等. 基于理想格的通用可组合两方口令认证密钥交换协议[J]. 电子与信息学报, 2021, 43(6): 1756–1763. doi: 10.11999/JEIT191029. SHU Qin, WANG Shengbao, LU Fanyi, et al. Universally composable two-party password-based authenticated key exchange from ideal lattices[J]. Journal of Electronics & Information Technology, 2021, 43(6): 1756–1763. doi: 10.11999/JEIT191029.
[5]	朱留富, 汪定. 支持商密SM9算法框架的多因素认证方案[J]. 电子与信息学报, 2024, 46(5): 2137–2148. doi: 10.11999/JEIT231197. ZHU Liufu and WANG Ding. A multi-factor authentication scheme under the SM9 algorithm framework[J]. Journal of Electronics & Information Technology, 2024, 46(5): 2137–2148. doi: 10.11999/JEIT231197.
[6]	霍威, 王科, 唐俊, 等. 一种基于人体轮廓形变场的双流网络步态识别方法[J]. 电子与信息学报, 2024, 46(10): 4062–4071. doi: 10.11999/JEIT231025. HUO Wei, WANG Ke, TANG Jun, et al. A dual-stream network based on body contour deformation field for gait recognition[J]. Journal of Electronics & Information Technology, 2024, 46(10): 4062–4071. doi: 10.11999/JEIT231025.
[7]	杜兰, 李逸明, 薛世鲲, 等. 结合相似度预测和阈值自动求解的开集条件下毫米波雷达点云步态识别方法[J]. 电子与信息学报, 2025, 47(6): 1850–1863. doi: 10.11999/JEIT241034. DU Lan, LI Yiming, XUE Shikun, et al. Millimeter-wave radar point cloud gait recognition method under open-set conditions based on similarity prediction and automatic threshold estimation[J]. Journal of Electronics & Information Technology, 2025, 47(6): 1850–1863. doi: 10.11999/JEIT241034.
[8]	YADAV T K and SEAMONS K. A security and usability analysis of local attacks against FIDO2[C]. 2024 Network and Distributed System Security Symposium, San Diego, USA, 2024: 1–15. doi: 10.14722/ndss.2024.24327.
[9]	BONNEAU J, HERLEY C, VAN OORSCHOT P C, et al. The quest to replace passwords: A framework for comparative evaluation of web authentication schemes[C]. 2012 IEEE Symposium on Security and Privacy, San Francisco, USA, 2012: 553–567. doi: 10.1109/SP.2012.44.
[10]	王平, 汪定, 黄欣沂. 口令安全研究进展[J]. 计算机研究与发展, 2016, 53(10): 2173–2188. doi: 10.7544/issn1000–1239.2016.20160483. WANG Ping, WANG Ding, and HUANG Xinyi. Advances in password security[J]. Journal of Computer Research and Development, 2016, 53(10): 2173–2188. doi: 10.7544/issn1000–1239.2016.20160483.
[11]	汪定, 陈晓峰, 马建峰, 等. MIT Technology Review 2022年“全球十大突破性技术”解读[J]. 中国科学基金, 2022, 36(3): 432–446. WANG Ding, CHEN Xiaofeng, MA Jianfeng, et al. Interpretation of 2022 MIT technology review's Top10 breakthrough technologies[J]. Bulletin of National Natural Science Foundation of China, 2022, 36(3): 432–446.
[12]	Verizon Business. 2025 data breach investigations report[R/OL]. https://www.verizon.com/business/resources/T735/reports/2025-dbir-data-breach-investigations-report.pdf, 2025.
[13]	WINDER D. Act now: 48 million Gmail usernames and passwords leaked online[EB/OL]. https://www.forbes.com/sites/daveywinder/2026/01/25/48-million-gmail-usernames-and-passwords-leaked-online/, 2026.
[14]	TUNGGAL A T. The 40 biggest data breaches of all time (updated July 2026)[EB/OL]. https://www.upguard.com/blog/biggest-data-breaches, 2026.
[15]	ANUPRIYA. 17.5 million Instagram accounts exposed in major data leak[EB/OL]. https://cyberpress.org/instagram-data-leak/, 2026.
[16]	GRIGAS L. Do women and men have similar password habits?[EB/OL]. https://nordpass.com/blog/women-men-password-habits/, 2026.
[17]	NEWMAN M L, GROOM C J, HANDELMAN L D, et al. Gender differences in language use: An analysis of 14, 000 text samples[J]. Discourse Processes, 2008, 45(3): 211–236. doi: 10.1080/01638530802073712.
[18]	WANG Y C, BURKE M, and KRAUT R E. Gender, topic, and audience response: An analysis of user-generated content on Facebook[C]. Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, Paris, France, 2013: 31–34. doi: 10.1145/2470654.2470659.
[19]	ANWAR M, HE Wu, ASH I, et al. Gender difference and employees' cybersecurity behaviors[J]. Computers in Human Behavior, 2017, 69: 437–443. doi: 10.1016/j.chb.2016.12.040.
[20]	WEI M, MINK J, EIGER Y, et al. SoK (or SoLK?): On the quantitative study of sociodemographic factors and computer security behaviors[C]. Proceedings of the 33rd USENIX Conference on Security Symposium, Philadelphia, USA, 2024: 392.
[21]	WEI M, EMAMI-NAEINI P, ROESNER F, et al. Skilled or Gullibleƒ gender stereotypes related to computer security and privacy[C]. 2023 IEEE Symposium on Security and Privacy, San Francisco, USA, 2023: 2050–2067. doi: 10.1109/SP46215.2023.10179469.
[22]	BRYANT K and CAMPBELL J. User behaviours associated with password security and management[J]. Australasian Journal of Information Systems, 2006, 14(1): 81–100. doi: 10.3127/ajis.v14i1.9.
[23]	BONNEAU J. The science of guessing: Analyzing an anonymized corpus of 70 million passwords[C]. 2012 IEEE Symposium on Security and Privacy, San Francisco, USA, 2012: 538–552. doi: 10.1109/SP.2012.49.
[24]	MAZUREK M L, KOMANDURI S, VIDAS T, et al. Measuring password guessability for an entire university[C]. Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, Berlin, Germany, 2013: 173–186. doi: 10.1145/2508859.2516726.
[25]	PETRIE H and MERDENYAN B. Cultural and gender differences in password behaviors: Evidence from China, Turkey and the UK[C]. Proceedings of the 9th Nordic Conference on Human-Computer Interaction, Gothenburg, Sweden, 2016: 9. doi: 10.1145/2971485.2971563.
[26]	WEIR M, AGGARWAL S, DE MEDEIROS B, et al. Password cracking using probabilistic context-free grammars[C]. 2009 30th IEEE Symposium on Security and Privacy, Oakland, USA, 2009: 391–405. doi: 10.1109/SP.2009.8.
[27]	WANG Ding, CHENG Haibo, WANG Ping, et al. Zipf’s law in passwords[J]. IEEE Transactions on Information Forensics and Security, 2017, 12(11): 2776–2791. doi: 10.1109/TIFS.2017.2721359.
[28]	WANG Ding, ZHANG Zijian, WANG Ping, et al. Targeted online password guessing: An underestimated threat[C]. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria, 2016: 1242–1254. doi: 10.1145/2976749.2978339.
[29]	DAS A, BONNEAU J, CAESAR M, et al. The tangled web of password reuse[C]. 21st Annual Network and Distributed System Security Symposium, San Diego, USA, 2014: 1–15. doi: 10.14722/ndss.2014.23357.
[30]	PAL B, DANIEL T, CHATTERJEE R, et al. Beyond credential stuffing: Password similarity models using neural networks[C]. 2019 IEEE Symposium on Security and Privacy, San Francisco, USA, 2019: 417–434. doi: 10.1109/SP.2019.00056.
[31]	XIE Zhijie, SHI Fan, ZHANG Min, et al. GuessFuse: Hybrid password guessing with multi-view[J]. IEEE Transactions on Information Forensics and Security, 2024, 19: 4215–4230. doi: 10.1109/TIFS.2024.3376246.
[32]	WANG Ding, ZOU Yunkai, XIAO Yuan’an, et al. Pass2Edit: A multi-step generative model for guessing edited passwords[C]. Proceedings of the 32nd USENIX Conference on Security Symposium, Anaheim, USA, 2023: 56.
[33]	NISENOFF A, GOLLA M, WEI M, et al. A two-decade retrospective analysis of a university's vulnerability to attacks exploiting reused passwords[C]. Proceedings of the 32nd USENIX Conference on Security Symposium, Anaheim, USA, 2023: 287.
[34]	RAO A, JHA B, and KINI G. Effect of grammar on security of long passwords[C]. Proceedings of the Third ACM Conference on Data and Application Security and Privacy, San Antonio, USA, 2013: 317–324. doi: 10.1145/2435349.2435395.
[35]	WANG Ding, WANG Ping, HE Debiao, et al. Birthday, name and bifacial-security: Understanding passwords of Chinese web users[C]. Proceedings of the 28th USENIX Conference on Security Symposium, Santa Clara, USA, 2019: 1537–1554.
[36]	MOHAMMAD S M and TURNEY P D. Crowdsourcing a word-emotion association lexicon[J]. Computational Intelligence, 2013, 29(3): 436–465. doi: 10.1111/j.1467-8640.2012.00460.x.
[37]	FAST E, CHEN Binbin, and BERNSTEIN M S. Empath: Understanding topic signals in large-scale text[C]. Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems, San Jose, USA, 2016: 4647–4657. doi: 10.1145/2858036.2858535.
[38]	U. S. Social Security Administration. Baby names from Social Security card applications-national data[DB/OL]. https://catalog.data.gov/dataset/baby-names-from-social-security-card-applications-national-data, 2026.
[39]	XU Ming, YU Jitao, ZHANG Xinyi, et al. Improving real-world password guessing attacks via bi-directional transformers[C]. Proceedings of the 32nd USENIX Conference on Security Symposium, Anaheim, USA, 2023: 57.
[40]	LI Zhen and WANG Ding. Targeted password guessing using k-nearest neighbors[C]. 33rd Annual Network and Distributed System Security Symposium, San Diego, USA, 2026: 1–18. doi: 10.14722/ndss.2026.232077.
[41]	UR B, NOMA F, BEES J, et al. "I added '!' at the end to make it secure": Observing password creation in the lab[C]. Proceedings of the Eleventh USENIX Conference on Usable Privacy and Security, Ottawa, Canada, 2015: 123–140.
[42]	ZOU Yunkai, AN Maoxiang, and WANG Ding. Password guessing using large language models[C]. Proceedings of the 34th USENIX Conference on Security Symposium, Seattle, USA, 2025: 400.
[43]	MELICHER W, UR B, SEGRETI S M, et al. Fast, lean, and accurate: Modeling password guessability using neural networks[C]. Proceedings of the 25th USENIX Conference on Security Symposium, Austin, USA, 2016: 175–191.
[44]	MA J, YANG Weining, LUO Min, et al. A study of probabilistic password models[C]. Proceedings of the 2014 IEEE Symposium on Security and Privacy, Berkeley, USA, 2014: 689–704. doi: 10.1109/SP.2014.50.
[45]	咸鹤群, 张艺, 汪定, 等. CSNN: 基于汉语拼音与神经网络的口令集安全评估方法[J]. 电子与信息学报, 2020, 42(8): 1862–1871. doi: 10.11999/JEIT190856. XIAN Hequn, ZHANG Yi, WANG Ding, et al. CSNN: Password set security evaluation method based on Chinese syllables and neural network[J]. Journal of Electronics & Information Technology, 2020, 42(8): 1862–1871. doi: 10.11999/JEIT190856.
[46]	PASQUINI D, ATENIESE G, and TRONCOSO C. Universal neural-cracking-machines: Self-configurable password models from auxiliary data[C]. 2024 IEEE Symposium on Security and Privacy, San Francisco, USA, 2024: 1365–1384. doi: 10.1109/SP54263.2024.00032.
[47]	SU Xingyu, ZHU Xiaojie, LI Yang, et al. PagPassGPT: Pattern guided password guessing via generative pretrained transformer[C]. 2024 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, Brisbane, Australia, 2024: 429–442. doi: 10.1109/DSN58291.2024.00049.
[48]	YANG Tao and WANG Ding. RankGuess: Password guessing using adversarial ranking[C]. 2025 IEEE Symposium on Security and Privacy, San Francisco, USA, 2025: 682–700. doi: 10.1109/SP61157.2025.00040.
[49]	ZOU Yunkai, WANG Ding, and DUAN Fei. Success rates doubled with only one character: Mask password guessing[C]. 33rd Annual Network and Distributed System Security Symposium, San Diego, USA, 2026: 1–18. doi: 10.14722/ndss.2026.241059.
[50]	ORENBACH Y and WOOL A. Watch and crack: Password inference from smart-glasses video[EB/OL]. https://arxiv.org/abs/2609.06539, 2026. doi: 10.48550/arXiv.2609.06539.
[51]	DUAN Mingjian, XU Ming, ZHANG Shenghao, et al. MoPE: A mixture of password experts for improving password guessing[C]. 2026 IEEE Symposium on Security and Privacy, San Francisco, USA, 2026: 3017–3036. doi: 10.1109/SP63933.2026.00191.
[52]	WANG Chenyang, SHI Fan, ZHANG Min, et al. CoT-DPG: A co-training based dynamic password guessing method[C]. 33rd Annual Network and Distributed System Security Symposium, San Diego, USA, 2026: 1–16. doi: 10.14722/ndss.2026.230755.
[53]	邹云开, 汪定. 口令猜测研究进展[J]. 密码学报, 2024, 11(1): 67–100. doi: 10.13868/j.cnki.jcr.000670. ZOU Yunkai and WANG Ding. Advances on password guessing attack[J]. Journal of Cryptologic Research, 2024, 11(1): 67–100. doi: 10.13868/j.cnki.jcr.000670.
[54]	CORRIAS W, DE GASPARI F, HITAJ D, et al. MAYA: Addressing inconsistencies in generative password guessing through a unified benchmark[C]. 2026 IEEE Symposium on Security and Privacy, San Francisco, USA, 2026: 2957–2976. doi: 10.1109/SP63933.2026.00081.
[55]	DELL’AMICO M and FILIPPONE M. Monte Carlo strength evaluation: Fast and reliable password checking[C]. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, USA, 2015: 158–169. doi: 10.1145/2810103.2813631.
[56]	JUOZAPAVIČIUS A, BRILINGAITĖ A, BUKAUSKAS L, et al. Age and gender impact on password hygiene[J]. Applied Sciences, 2022, 12(2): 894. doi: 10.3390/app12020894.