The current research with EEG devices in the user authentication context has some deficiencies that address expensive equipment, the requirement of laboratory conditions and applicability. In this paper we address this issue by using widely available and inexpensive EEG device to verify its capability for authentication. As a part of this research, we developed two phase authentication that enables users to enhance their password with the mental state by breaking the password into smaller, marry them with mental state, and generate one time pad for a secure session.