Click the Choose picture button, browse to your preferred image directory, and choose the image you'd like to use as a base for your gestures. The picture is the only thing you'll see when logging in, so try to pick an image with a resolution sufficient that the image remains attractive when splayed across your screen. Once you select the image, you're asked to position it on-screen; simply drag the image to your desired location and click the Use this picture button.
Time to start gesturing. This process is obviously designed for touchscreen PCs and tablets, but it works with a mouse as well. Remember the order and direction of all of the gestures you drew on the screen; if you draw a line from left to right in the image, for example, you'll also have to draw the line from left to right when unlocking your system.
For maximum security, avoid taps and use circles and lines exclusively. These gestures are harder to guess because they incorporate both positional data and directional data, so an unauthorized user would need to correctly deduce the start point, end point, and direction of your gesture. Every security expert we spoke to about this process cautioned against using gestures that follow the contours of the image in predictable ways, like circling faces or drawing lines between landmarks. Instead, pick an image with strong contrast to create bright reference points, and come up with a creative, convoluted series of gestures to make your password extra strong.
Once you've finished doodling your new password, you should be ready to rock. Window 8 defaults to the picture password anytime the system is locked or restarted, and ideally all you have to do is draw your gestures on screen to unlock the system.
If you want to switch gears and input your plaintext password instead, just tap the corresponding button in the left pane of the picture password screen. You should also be aware that picture password logins can be disabled from within the Windows 8 group policy editor; many businesses do not allow picture passwords to be used on networked machines for security reasons, so be prepared for that if you plan to bring your Windows 8 device to work.