Passthoughts: User Authentication Using Brainwaves


With the embedding of EEG (electro-encephalography) sensors in mobile headsets, sunglasses, and other wearable consumer devices, authenticating users based on their brainwave signals has become a realistic possibility. Through a series of experimental studies, we have successfully accomplished the following:

  • one-step two-factor authentication by providing both the knowledge and inherence factors in a single user action (i.e., think your passthought)
  • one-step three-factor authentication using custom-fit EEG earpieces
  • 99%+ authentication accuracy using consumer-grade single-channel EEG signals
  • 99%+ authentication accuracy using EEG signals captured from the ear
  • demonstrate robustness against imposter attacks
  • demonstrate and remove vulnerability against attacks using generative adversarial networks

Overview Presentation

Logging in with Your Thoughts?
J. Chuang. UC Berkeley Class of 2013 Homecoming Lecture, October 12, 2018.


One-Step, Three-Factor Passthought Authentication with Custom-Fit, In-Ear EEG
N. Merrill, M. Curran, S. Gandhi, J. Chuang. Frontiers in Neuroscience, April 2019.

Faking it, Making it: Fooling and Improving Brain-Based Authentication with Generative Adversarial Networks
T. Piplani, N. Merrill, J. Chuang. Proceedings of IEEE International Conference on Biometrics: Theory, Applications, and Systems (BTAS 2018), October 2018.

Exploring the Feasibility and Performance of One-Step Three-Factor Authentication with Ear-EEG
M. Curran, N. Merrill, S. Gandhi, J. Chuang. Proceedings of 5th International Conference on Physiological Computing Systems (PhyCS 2018), September 2018. Best Student Paper Award

From Scanning Brains to Reading Minds: Talking to Engineers about Brain-Computer Interface
N. Merrill, J. Chuang. ACM CHI Conference on Human Factors in Computing Systems (CHI 2018), April 2018.

Is the Future of Authenticity All In Our Heads? Moving Passthoughts From the Lab to the World
N. Merrill, M. Curran, J. Chuang. New Security Paradigms Workshop (NSPW ’17), October 2017.

One-Step, Three-Factor Authentication in a Single Earpiece
M. Curran, N. Merrill, S. Gandhi, J. Chuang. Adjunct Proceedings of ACM UbiComp/ISWC, September 2017.

Passthoughts Authentication with Low Cost EarEEG
M. Curran, J. Yang, N. Merrill, J. Chuang. Proceedings of 38th Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC 2016), August 2016.

Passthoughts on the Go: Effect of Exercise on EEG Authentication (Extended Version)
G. Chuang, J. Chuang. Proceedings of 38th Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC 2016), August 2016.

Improving Physiological Signal Classification Using Logarithmic Quantization and a Progressive Calibration Technique
N. Merrill, T. Maillart, B. Johnson, J. Chuang. 2nd International Conference on Physiological Computing Systems (PhyCS'15), February 2015.

My Thoughts are Not Your Thoughts: Robustness of Brainwave Signal Authentication Against Impersonation Attacks
B. Johnson, T. Maillart, J. Chuang. Workshop on Usable Privacy & Security for wearable and domestic ubIquitous DEvices (UPSIDE'14), ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp'14), September 2014.

One-Step Two-Factor Authentication with Wearable Bio-Sensors
J. Chuang. Workshop on "Who are you?! Adventures in Authentication" (WAY'14), 10th USENIX Symposium on Usable Privacy and Security (SOUPS'14), July 2014.

I Think, Therefore I Am: Usability and Security of Authentication Using Brainwaves
J. Chuang, H. Nguyen, C. Wang, B. Johnson. Workshop on Usable Security (USEC'13), Proceedings of the Seventeenth International Conference on Financial Cryptography and Data Security (FC'13), April 2013.

Media Coverage

Our research has been covered by over 300 international media outlets, including:

Videos and Animations

BBC Click: Could passthoughts replace the password?

CalConnect: Brainwaves and Passthoughts

KRON4 News: Brainwaves as passwords

Igor Bastidas for Neo.Life: When Computers Read Your Mind, You'll Need a Great Passthought

Funding Support

This research has ben supported in part by the National Science Foundation under award CCF-0424422 (TRUST), by a Google Faculty Research Award, and by the UC Berkeley Center for Long-Term Cybersecurity and the Hewlett Foundation.