Brainwave Passwords Can Be Hacked, New Study Warns

Forget typing a password—some researchers want to use your brainwaves as a security key. The idea is simple: every person's brain produces unique electrical patterns, seen through an EEG cap, and these patterns could unlock your phone, bank account, or smart home. But a new study shows this futuristic security has a serious flaw: those brainwave "fingerprints" can be stolen and faked.

The researchers, from computer science and security fields, built "adaptive attack" algorithms that learned to fool EEG authentication systems. The scary part? These attacks worked without any knowledge of how the security system itself was built. In plain terms, attackers don't need a blueprint of the lock—they just need a copy of your key (your brainwave recording), then they can tweak that copy to open the door. The fake recordings passed as genuine across six different public brainwave datasets.

Perhaps most striking, the researchers found that your vulnerability depends on what you're doing when your brainwaves are recorded. Systems using brainwaves taken while you rest, while you look at images, or while you imagine moving your hand all showed different levels of vulnerability. So if a hacker knows you were "resting" when you set up your biometric lock, they might have an easier time breaking in. That makes it much harder to create one universal standard for brain-based security.

The good news: the paper also offers recommendations to make neural biometrics stronger, like mixing brain tasks or combining brainwaves with other security checks. But for now, think of brainwave passwords like early fingerprints—a cool idea, but not ready to protect your bank account without a lot more work.