Psychological research on memorability of passwords? There are lots of ad-hoc rules that people are happy to propose about passwords, such as:


Pick a phrase you can remember easily, and then use the initial letters.
A random short sequence of letters, numbers and symbols.
A sequence of random common words (like XKCD's "battery correct horse staple").


There is also a pile of computer security research on what passwords are hard to crack.

It seems like a pretty simple empirical question to say what is the best password scheme for any given desired strength.

Can anyone point me to any research about the ease of memorizing passwords generated according to various rules?
It looks like there is some empirical evidence that passphrases are easier to remember than either random passwords (not surprising) or user-selected short passwords after standard advice to use mix of upper and lower and avoid words.

http://homepages.cs.ncl.ac.uk/jeff.yan/#exp

Thanks Jeff for the pointer in a comment (same Jeff?).


  J. Yan, A. Blackwell, R. Anderson and A. Grant. The memorability and
  security of passwords -- some empirical results. University of
  Cambridge, Computer Laboratory Technical Report No. 500, 2000. (see
  also Hungarian translation). PDF
  
  J. Yan, A. Blackwell, R. Anderson and A. Grant. Password Memorability
  and Security: Empirical Results. IEEE Security &amp; Privacy, Vol. 2 No.
  5, 2004. PDF


the above is reprinted as:


  J. Yan, A. Blackwell, R. Anderson and A. Grant. The Memorability and
  Security of Passwords. Refereed book chapter in Security and
  Usability: Designing Secure Systems that People Can Use (ed. by Lorrie
  Cranor and Simson Garfinkel), OReilly &amp; Associates, USA, 2005.