Freestyle in-air-handwriting passcode-based user authentication methods address the needs for Virtual Reality (VR)/Augmented Reality (AR) headsets, wearable devices, and game consoles where a physical keyboard cannot be provided for typing a password, but a gesture input interface is readily available. Such an authentication system can capture the hand movement of writing a passcode string in the air and verify the user identity using both the writing content (like a password) and the writing style (like a behavior biometric trait). However, distinguishing handwriting signals from different users is challenging in signal processing, feature extraction, and matching. In this paper, we provide a detailed analysis of the global features of in-air-handwriting signals and a comparative evaluation of such a user authentication framework. Also, we build a prototype system with two different types of hand motion capture devices, collect two datasets, and conduct an extensive evaluation.