A user authentication system using "unclear images" as pass-images has been proposed, in which only legitimate users can understand their meaning by viewing the original images corresponding to these unclear pass-images, which are meaningless to unauthorized users. Hence, it is difficult for attackers to memorize them, even though they may have observed authentication trials by legitimate users. This paper reports another advantage of the user-authentication system using unclear images: their adaptation enables decoy images to be automatically generated, which are displayed along with the pass-images in the authentication window. Here, we explore various methods of automatically generating decoy images.