Methods and systems for authenticating a user include presenting a list of themes on a user interface of a client device for user selection. Images of a plurality of objects and query prompts are presented on a client device for a theme selected from the list. Images of objects selected in response to the query prompts are received and verified to determine that the objects that are selected are theme-based objects and correspond to the query prompts. The selected objects are stored as answers to the query prompts identified for the theme and are used for authenticating the user during subsequent requests received from an application that is used to access a sensitive, digital asset.