There have been numerous attempts to replace or re-design knowledge-based authentication. Despite these endeavours, driven by known usability and security weaknesses, traditional password-based systems have remained ubiquitous. Graphical passwords have emerged and re-emerged in different forms as a proposed solution. The broad argument is that such passwords should be easier to remember, easier to use, and more secure. Psychological jargon is often used to justify these claims, but what does the real psychology suggest?