Passfaces - "how does it work?"
Passface utilises the in built cognitive abilities that we all have (and have been practicing since birth) to effectively plant a 'cookie' in the brain (rather than the a computer that can be compromised), thus enabling the user to be authenticated rather than the computer, every time, anywhere. |
![]() |
"I never forget a face'"
It's true, we never forget a face. We might not be able to associate a name with a face, but the brain can recognize a face for months, or even years after the first encounter. It's that scientific fact that serves as the basis for Passfaces technology. Users are given a random set of faces (typically 3 to 7) to serve as their password (taking into account the combination of security, usability and practicality). They are then taken through a "familiarization process" that imprints the faces in their mind. Users then log into protected systems by selecting their assigned faces from five different groups, each containing nine faces. These groups are presented one at a time until all five of the Passfaces have been correctly identified.
Each Passface is presented to the user in a grid, typically 3 faces by 3 faces, that contains the assigned Passface and 8 decoys that are similar in appearance. The 3x3 grid has an obvious advantage in that it maps directly to a numerical keypad allowing Passfaces to be used on devices such as ATMs and Web TVs where this may be the only means of user input.
Using five Passfaces picked from five 3x3 grids provides 95 combinations or 1 chance in 59,049 that someone could guess the Passfaces at random. This is sufficient for many consumer and business applications provided. For comparison, consider the four-digit user-selected PIN used globally on ATM networks. The chances of someone guessing a PIN are less than 1 in 10,000. Higher security is achieved by using more than 5 Passfaces. There is no known limit to the number of faces that a person can remember.
Passfaces can be used with another authenticator, such as a password or a token, as part of a two-factor "strong" authentication scheme.

