The death of the password has been announced so often that the phrase is a punchline among the security professionals who keep having to revive the patient. For two decades every scheme that promised to retire the humble string of characters ran aground on the same rocks: too clumsy, too proprietary, or simply not on enough devices to matter. Yet this time the very people who spent careers rolling their eyes at the obituaries are quietly conceding that the end may be near. The reason is not a slogan. It is a piece of engineering called the passkey, and by mid-2026 it ships on essentially every phone and laptop sold.
A passkey is, plainly, a cryptographic key pair tied to your device. Create one for a website and your phone or laptop generates two mathematically linked keys: a private one that never leaves the secure hardware, and a public one handed to the site. To log in, the site sends a challenge; your device signs it with the private key once it has confirmed you are present, usually with a fingerprint or a glance. The site checks the signature against the public key it already holds. No secret crosses the network, and the site stores nothing an attacker could steal and reuse. That last sentence is the whole revolution, compressed.
Why this time is different
That architecture quietly dismantles the entire economy of password crime. There is nothing to phish, because there is no shared secret to trick out of you; a fake login page collects a signature useless anywhere else. There is nothing to leak in a breach, because the site only ever held a public key. And there is nothing to guess, because the private key is a long random number guarded by hardware, not a word reused across nine accounts. The three most common ways people lose control of their digital lives — phishing, credential stuffing, database leaks — do not fail gracefully. They stop working altogether.
"You cannot phish a secret that never leaves the device, and you cannot leak one the website never held. That is the entire trick — and it is a very good trick."
A security engineer at a European identity provider — interviewed for this articleThe earlier death-of-the-password movements failed because they were islands. A hardware token you had to buy; an app one bank used and nobody else; a biometric scheme welded to a single manufacturer. What changed is that the major platform vendors agreed on a common standard, built it into their operating systems, and made passkeys sync across a person's devices through the accounts they already have. The result is the one thing every previous attempt lacked: ubiquity. The replacement is already in your pocket, whether or not you have noticed.
The friction that remains
None of which makes the transition painless. The migration is the awkward stretch, and it is genuinely awkward. Most services still run passwords alongside passkeys, so users live in a confusing hybrid where old login and new coexist and switching the password fully off stays rare. People are asked to trust an invisible mechanism they do not understand — which breeds exactly the hesitation that slows adoption.
The harder, unglamorous problem is recovery. A password lives in your head; a passkey lives in your device's hardware and your platform account. Lose the phone, lose the account that syncs it, and you can be locked out of your own digital life with no familiar fallback. The platforms have built recovery paths, but they are intricate, they differ by vendor, and they reintroduce the very weaknesses passkeys were meant to abolish — because a recovery channel is, almost by definition, a back door left ajar. Solving login was the easy part. Solving graceful, secure recovery for billions of ordinary people who will absolutely lose their phones is the work that decides how complete the victory is.
So the obituary reads closer to accurate than ever before — but it carries an asterisk. The password will not vanish on a fixed date; it will fade, account by account, as the friction eases and the recovery story matures. For the first time, though, its successor is not a promise on a conference stage. It is already here, already working, and already logging hundreds of millions of people in without a single character typed.