User-Centric Risk Communication for Password Managers: A Framework for Adaptive Alerts and Onboarding
Mohammed Jubur · 2025
Password managers promise to relieve the burden of credential management by centralizing encryption and storage, yet many users remain uncertain about their inner workings and real-world security guarantees. This paper introduces a risk-profiling framework that tailors alerts and onboarding to user expertise, behavioral cues, and threat landscapes, focusing on dynamic warnings and progressive disclosure to reduce common misconceptions. Our approach employs a lightweight scoring method to classify users as low, medium, or high risk, and integrates contextual guidance to address challenges such as password guessability, breach-driven distrust, and friction when switching between password managers. By aligning user actions with timely and adaptive messaging, we aim to improve both practical adoption and long-term security outcomes.