Tech Graveyard/authentication
The Password (1961 to Dying)
I founded a CIAM platform in 2013 that scaled to more than 1 billion users. Even from inside the industry, I missed how fast passkeys would flip the model.
Born 1961 · Still dying, projected end 2030 · Status: dying
By Deepak Gupta · Published · Last updated
Paired prediction: what replaces it in Future Tech
Certificate of Death
Name of decedent
The Password
- Born
- 1961
- Died
- Not yet
- Age
- 65+
Cause of death
Apple, Google, and Microsoft committed to passkeys in 2022 and shipped them across their platforms
Survived by
Passkeys, WebAuthn, FIDO2, platform authenticators
Invented by
Fernando Corbato, MIT Compatible Time-Sharing System
The hook
Verizon's 2017 breach report found 81% of hacking-related breaches used stolen or weak passwords. The password is not failing because it is bad. It is failing because something easier finally arrived.
Thesis. The password has held on for more than 60 years through pure inertia. Passkeys are not winning by being more secure. They are winning by being faster to use than the password they replace.
The story
The origin
Fernando Corbato's CTSS at MIT, 1961. Passwords were a quick hack to keep users from reading each other's files on a shared mainframe. Not designed for the internet. Not designed for 100 apps per person.
The expansion
Every app that came after just copied the pattern. A 2007 Microsoft Research study counted about 25 password-protected accounts per user. NordPass put the average at around 100 passwords in 2020. The model scaled out of the conditions it was designed for, and nobody fixed the primitive underneath.
The failed fixes
Complexity rules, rotation policies, password managers, breach databases. Each made the user experience worse without solving the underlying problem. The industry spent two decades polishing a primitive that could not be polished into safety.
The pivot
May 2022. Apple, Google, and Microsoft commit to expand support for FIDO passkeys. Apple ships passkeys in iOS 16 that September. Google adds them to Android, then Chrome 108 by December. Microsoft brings them to Windows 11 in 2023. Three platform owners backing the same replacement within months has happened maybe twice in computing history.
The outlook
Passkey sign-in spread across major consumer apps in 2024 and 2025. Amazon added passkeys in October 2023, alongside passwords rather than replacing them. Enterprise adoption usually trails consumer adoption by years. My projection: final breath around 2030 in consumer, 2032 in enterprise, later in regulated industries.
Key data points
- First password: MIT CTSS, 1961 (Fernando Corbato)
- Verizon DBIR 2017: 81% of hacking-related breaches used stolen or weak passwords
- Apple passkey support announced: WWDC June 2022
- Amazon passkey sign-in launched: October 2023
- Accounts able to use passkeys: more than 15 billion (FIDO Alliance, late 2024)
Contrarian angle
The security community spent 20 years trying to make passwords better. The win came from accepting they could not be fixed and starting over.
The flip side
What replaces it
The paired prediction in Future Tech.
Read the prediction◆ Technology Rewired
See the full evolution in Technology Rewired:
FAQ
Have passkeys surpassed passwords yet?
Not yet. The FIDO Alliance counted more than 15 billion accounts able to use passkeys by late 2024, but far fewer people actually use them. Existing accounts migrate more slowly than new signups.
Why didn't password managers solve this?
Password managers made the worst part of passwords (typing them) bearable without fixing the underlying problem (shared secrets that get phished, breached, and replayed). They were a workaround, not a replacement.
Are passwords actually dead or just dying?
Dying. Dead is the wrong word until the bottom 50% of websites migrate, which will take until 2030 in consumer and longer in regulated industries.
Is biometric auth the same as passwordless?
No. Biometrics unlock the passkey on your device, but the credential exchanged with the server is a cryptographic key, not your fingerprint. The biometric never leaves the device.
More from guptadeepak.com
Further reading
Related obituaries
More from the authentication graveyard.
2011 to dying
DyingSMS-Based MFA
The most cited example of cybersecurity inertia. NIST restricted SMS MFA in 2017. SIM swaps against Twitter's co-founder in 2019 and the SEC's X account in 2024 kept the risk in the headlines.
Cause: SIM-swap attacks on high-profile accounts forced regulatory action
authentication · Peak 2018 · Projected end 2027
c. 1,000 BC to dying
DyingThe Wet-Ink Signature
I spent a career building consent into software, and the whole time the legal system ran on a squiggle a child could forge. The wet-ink signature was security theater that lasted three millennia. It is finally dying.
Cause: Remote work and digital contracts made physical ink impractical, and e-signature was both faster and more verifiable. Cryptographic signing then made the handwritten mark legally and technically redundant.
authentication · Peak 1990 · Projected end 2030