Built me a graphical password authentication tool

Proposed scheme In the new approach called Sequenced PassPoint (SPP), unlike PassPoint which had many clicks on a single image, fewer ordered clicks are made on multiple ordered images with SPP. The user will be provided with four images including two unfamiliar decoys to reduce susceptibility to shoulder-surfing. The complexity is further amplified with two additional decoy images with three phony click points. The introduction in the process of reversing the order of the click points sequence when the real images are passed in reverse order is another robust feature. Registration Phase The user enters the username and other pertinent research information with no personal identifiers. Some images are presented to the user to choose two to set as a password. The user is passed the two images of individual choice in order, one after the other. The user selects three locations in order on each of the two images to register a password. These selected images in the proposed machine are added to the profile so that user can affirm the picture selections later during authentication. It will disappear after 5 seconds. This makes the system comfortable as well as user-friendly. The user enters the username and other pertinent research information with no personal identifiers. The user selects any two additional images from the picture database as decoys. These selected images in the proposed scheme are added to the profile so that user can affirm the picture selections later during authentication. Authentication Phase 1. User type in a username. 2. The user is passed four images. 3. The user makes three phony clicks on all the decoy images in consistent locations of choice for confusing a hacker with a recorder. If the passed image is the one the user selected during registration, the user will select the registered ordered click points and fake click points in this way: a) If a real image in the registration order, click the three password points in order. b) If a real image but in reverse order, click the three password points in reverse order. c) If a fake image, click any three points in a reasonable consistent manner or order. The images are passed in a different order each time during the login process. It is difficult to guess which points are real and which are fake. These combinations of image order click points add some complexity to the scheme. SPP only allows three unsuccessful attempts and will lock the account after the third unsuccessful try. The tolerance is adjusted reasonably to a practical level. During the password entry process, the user will select three randomly click points on the decoy images but advised to click in similar locations all the time. The decoy images will always be shuffled within the required two user images with the idea that a record of the clicks on the images will not help an eavesdropper.