A website asks for a password: at least eight characters, one uppercase letter, a number and a special symbol. A month later you need it again, but three nearly identical versions come to mind. After a few failed attempts, the familiar “Reset password” email arrives.
It is remarkable that one of the most important layers of digital security spent decades relying on a human being’s ability to remember a secret. Passwords survived the personal computer, the consumer internet, smartphones and biometrics. In 2026 they are still everywhere, but their replacement finally looks less like a demo and more like infrastructure.
Passwords began on a shared computer
In the early 1960s, MIT researchers were building the Compatible Time-Sharing System, or CTSS. Several people could use the same large computer through separate terminals. Once users had private files, a practical problem appeared: how do you stop somebody else from signing in as you?
Fernando Corbató’s team used individual passwords. MIT CSAIL notes that CTSS is generally credited with introducing computer passwords. For that environment the idea was elegant: identify the user, then ask for a secret that only that person should know.
The internet turned a simple idea into a daily burden
Two or three passwords are manageable. Email, forums, online shops, social networks, banks, government portals and workplace tools changed the arithmetic. The safest advice — use a unique strong password everywhere — eventually became incompatible with ordinary human memory.
People reused passwords, chose birthdays and names, or made tiny variations of the same phrase. Security policies responded with increasingly complicated composition rules. Some of those rules have since been reconsidered. Current NIST guidance puts more weight on length and blocking common or compromised passwords, and states clearly that passwords are not phishing-resistant. The current NIST guidance explains the approach.
A passkey removes the secret you have to hand over
For the user, a passkey can feel almost trivial: confirm a sign-in with Face ID, a fingerprint or the device PIN. Underneath, public-key cryptography is doing the work. The service keeps a public key; the private key remains on the device or inside a protected synchronisation system.
A passkey is bound to the legitimate website, so a convincing fake page cannot simply collect the same reusable secret. In August 2026 the W3C published Web Authentication Level 3 as a web recommendation.
By 2026 this is no longer niche
FIDO Alliance estimates that around 7 billion passkeys have been created globally. Among the major services contributing to its Passkey Index, passkeys now account for 36% of successful sign-ins, up from 26% a year earlier. That sample is not the entire internet, but it is large enough to show a real behavioural shift. The 2026 Passkey Index also reports higher sign-in success for passkey-based flows than for traditional multi-factor authentication.
Large platforms are beginning to make passkeys a default rather than an optional setting. Microsoft announced in 2026 that passkeys would become the default authentication method for Entra ID, with rollout beginning in September. Its security update frames the change as part of a wider move toward phishing-resistant authentication.
Why passwords will linger
The internet is full of legacy systems: old corporate software, network hardware, small websites and services that do not yet support modern authentication. Passwords are cheap to implement and understood almost everywhere. Account recovery is another stubborn problem, especially when a user loses every trusted device.
So there probably will not be a single day when the password field disappears from the web. A more realistic transition is that passwords stop being the primary way most people sign in and survive mainly as a fallback for older systems or recovery.
The meaningful end of the password era
The change will be most obvious in ordinary behaviour. A new phone will offer to create a passkey during the first sign-in. The next visit will open after a face or fingerprint check. People will stop inventing new password variations and gradually forget the old ones.
Passwords may remain deep inside technical systems for years. For everyday users, though, the password era can end much earlier — when typing one becomes the unusual fallback rather than the normal first step.
