Updated answer. For the picture password:

>! Tap the squares next to 3, 9 then 8.

Because

>! The character **Sakuya** is underlined. You can break up her name into three sounds: SA, KU, YA. Those syllables sound like the corresponding digits in Japanese: 3 (san), 9 (kyuu), 8 (hachi / See below for it's connection with "ya")

For reference for people who aren't too familiar with Touhou and Japanese

>! **Numbers**  
>! 1 - ichi  
>! 2 - ni  
>! 3 - san  
>! 4 - yon / shi  
>! 5 - go  
>! 6 - roku  
>! 7 - nana / shichi  
>! 8 - hachi  
>! 9 - kyuu  
>!   
>! **Characters**  
>! 1 - Hakurei Reimu (I don't see a relationship between her name and 1)  
>!  One of the main playable characters, boss in Imperishable Night (8th game, stage 4)  
>!   
>! 2 - Chen (She says "Nyaa" which has the "ni" sound in it)  
>!  Boss in Perfect Cherry Blossom (7th game, stage 2)  
>!  
>! 3 - Izayoi Sakuya (I don't see a relationship between her name and 3)
>!  Boss in Embodiment of Scarlet Devil (6th game, stage 5)  
>!  
>! 4 - Konpaku Youmu (She says "Myon" which has the "yon" sound in it)  
>!  Boss in Perfect Cherry Blossom (7th game, stage 5)  
>!  
>! 5 - Alice Margatroid (She says "Gossun" which has the "go" sound in it)  
>!  Boss in Perfect Cherry Blossom (7th game, stage 3)  
>!  
>! 6 - Kamishirasawa Keine (Not sure about the relationship with 6)  
>!  Mid-stage boss in Imperishable Night (8th game, extra stage)  
>!  
>! 7 - Remilia Scarlet (Not sure about relationship with 7, but 7 is written the same way as "ku" in katakana)  
>!  Boss in Embodiment of Scarlet Devil (6th game, stage 6)  
>!  
>! 8 - Yakumo Yukari (The "Ya" in "Yakumo" is the same character as 8)  
>!  Boss in Perfect Cherry Blossom (7th game, phantasm stage)  
>!  Maybe relevant, but Yakumo Ran is the boss to the extra stage  
>!  
>! 9 - Cirno (Pronounced Chi-ru-no, 9 comes from the game's user manual depicting her easy mode spellcard that can be beat by just standing in front of her)  
>!  
>!  **Connection to Ran's Suspicions**  
>!  The episode connects a word to a passcode. Specifically, **Sherlock** becomes 4869, which can translate to "shi-ha-ro-kyuu", sounding like "Sherlock"