Motion Passwords

March 2026

What is the paper about?

The paper introduces Motion Passwords, a new biometric authentication method for eXtended Reality (XR). Instead of typing on a virtual keyboard, users are able to write a secret word in mid-air with their hand controller. The system is able to check both the chosen word (knowledge) and the users’ unique motion style (biometric and motion dynamics).

What are the results?

• Dataset & Protocol: 48 participants performed over 3.800 written signatures in two sessions.
• Compare two different Models:
  • A classic feature‑distance classifier (determine the similarity or distance between two samples directly, do not require training phase).
  • A similarity-learning model (learn the motion profile of individuals even within complex and arbitrary motions).
• Performance:
  • The similarity‑learning model achieved verification accuracy on Motion Passwords comparable to previous VR gesture methods (like ball‑throw patterns).
  • The similarity-learning model verifies users by focusing on their motion profiles rather than exact trajectories, achieving high success rates even when the wrong word is used.
  • One significant advantage of Motion Passwords is potentially the resistance against shoulder-surfing attacks
• Prototype: A Unity application shows real‑time sign-up and verification using the pretrained model.
• Resources released: Dataset, codebase, pretrained model, and Unity prototype are publicly available.

What are possible fields of application?

• Secure VR/XR login: Games, social apps, or enterprise workspaces.
• Virtual access control: Private meetings, classrooms, or restricted areas in the metaverse.
• Multi‑factor authentication: Combine Motion Passwords with PINs or traditional passwords.
• Continuous Authentication: Periodic, quick motion checks during a session.

How does the research in the paper contribute to shaping the metaverse?

• Boosts trust & safety: Ensures users in XR spaces are who they claim to be, vital for social XR, commerce and collaboration.
• Seamless UX: Writing in air feels natural and keeps users immersed.
• Privacy‑friendly biometrics: Unlike camera‑based face or iris scans, Motion Passwords rely only on controller tracking data, reducing exposure of sensitive personal imagery.
• Foundation for richer identity: Fits into multi-modal stacks (knowledge + behaviour + biometrix), paving the way for continuous, user-centered, privacy-aware identity in large-scale virtual worlds.

Reference

Christian Rack, Lukas Schach, Felix Achter, Yousof Shehada, Jinghuai Lin, and Marc Erich Latoschik. 2024. Motion Passwords. In Proceedings of the 30th ACM Symposium on Virtual Reality Software and Technology (VRST ‘24). Association for Computing Machinery, New York, NY, USA, Article 19, 1–11. https://doi.org/10.1145/3641825.3687711