User-Centric Risk Communication for Password Managers: A Framework for Adaptive Alerts and Onboarding

Password managers promise to relieve the burden of credential management by centralizing encryption and storage, yet many users remain uncertain about their inner workings and real-world security guarantees. This paper introduces a risk-profiling framework that tailors alerts and onboarding to user expertise, behavioral cues, and threat landscapes, focusing on dynamic warnings and progressive disclosure to reduce common misconceptions. Our approach employs a lightweight scoring method to classify users as low, medium, or high risk, and integrates contextual guidance to address challenges such as password guessability, breach-driven distrust, and friction when switching between password managers. By aligning user actions with timely and adaptive messaging, we aim to improve both practical adoption and long-term security outcomes.