Pictorial passwords, where the user recognizes “target” images among “distractors”, appear to have potential for improving the usability of authentication systems. We conducted three exploratory studies on the use of personal photos for authentication over a three-month period. Participants provided 8-20 photos of personal significance to them but which they believed others would not recognize. They also chose four photos to remember from a set of stock photos. Recognition accuracy for the personal photos was significantly higher than the stock photos. We also manipulated the number of target and distractor photos as well as their similarity, and we tested how well others who know the users could guess their photos. Larger numbers of distractors and greater similarity to the targets made it harder for others to guess the correct photos, while having no impact on the user’s own recognition accuracy.