The Password Is Dying, Again (2026)
TL;DR
The prediction that "the password is dead" has been made roughly every five years since 2004, and it has been wrong every time. It is being made again in 2026. The difference is that this time the structural conditions for replacement — a standardized protocol, platform-level defaults, consumer fatigue, and regulatory pressure — actually exist. The prediction was early, not wrong. Passwordless authentication is arriving through passkeys for personal devices and biometric identity verification for shared terminals, and the question for decision makers is no longer whether to transition but which layer to build first.
The Big Picture: A Prediction That Kept Coming Back
In February 2004, Bill Gates used his RSA Conference keynote to declare that the password was approaching the end of its useful life. He pointed to phishing, reuse, and the sheer volume of credentials an average person was already expected to remember. The prediction made the rounds. It also did not come true. People kept using passwords.
The industry kept trying anyway. The FIDO Alliance was founded in 2012 to build an open standard for passwordless authentication. Apple, Google, and Microsoft made various commitments at various points. Security vendors released hardware tokens. Analysts published trend decks. Each cycle followed the same arc: a bold declaration, a wave of pilots, a failure to reach ubiquity, a quiet reversion to the password — now layered with a second factor that made it marginally harder to phish but did not remove the shared secret at its core.
The question worth asking, two decades in, is not "is the password dead yet?" That framing has been wrong every time it's been tried. The better question is: what were the structural conditions that prevented replacement, and have they changed?
Why the Password Outlived Every Obituary
Passwords are a bad technology that won for structural reasons. Understanding those reasons is the prerequisite to evaluating whether they've been overcome.
The password had zero coordination cost. A developer could implement password authentication in an afternoon with a hash function and a database. No protocol negotiation, no hardware dependency, no third-party service to integrate. Every framework shipped with it. Every user understood the mental model. Every identity provider supported it. The network effect was total.
The password had zero hardware dependency. A password works on any device with a keyboard — a 2004 Dell laptop, a 2026 iPhone, a terminal in a server rack, a smart TV's on-screen keyboard. No secure enclave, no biometric sensor, no trusted execution environment. The replacement technologies — hardware tokens, biometric sensors, platform passkeys — all required something the password did not: a device capable of doing more than accepting text input.
The password had universal user literacy. By 2004, every internet user had been trained to create, forget, reset, and reuse passwords. That training was expensive in aggregate — help-desk costs, breach costs, productivity loss — but it was already paid. Any replacement required re-training the entire internet's user base, and no single vendor could justify that investment alone.
The replacement required coordination across competitors. A password replacement only works if the service, the browser, the operating system, and the device manufacturer all agree on the protocol. For most of the last twenty years, they didn't. Apple, Google, and Microsoft each had incentive to build a proprietary alternative; none had incentive to standardize. The FIDO Alliance existed on paper, but for years its standards were more aspiration than deployment.
The password survived not because it was good but because it was free, universal, and required no one to agree with anyone else. Every obituary underestimated the inertia of a technology whose only real advantage was that it already existed everywhere.
Why This Time Looks Different
The conditions that protected the password are weakening — not all at once, but in a sequence that looks structurally different from previous cycles.
The standardization problem is largely solved. The FIDO Alliance's CTAP (Client to Authenticator Protocol) and the WebAuthn API are now implemented in every major browser, every major operating system, and the two dominant mobile platforms. The coordination problem that killed previous attempts — Apple, Google, and Microsoft refusing to interoperate — has been addressed through a credential exchange protocol announced in 2024 and now shipping in production. A passkey created on an iPhone can be used on a Windows laptop. A passkey created in Google Password Manager can be exported to 1Password. The protocol layer is no longer the blocker.
Platform defaults have flipped. The single most important change is that the major platforms are no longer offering passkeys as an option — they are defaulting to them. Google made passkeys the default sign-in method for personal accounts in 2023 and reported a 352% increase in passkey authentications afterward. Microsoft defaulted new accounts to passkeys and saw a 120% increase. When Gemini began requiring a passkey in May 2025, authentications jumped 269%. The FIDO Alliance reported 5 billion passkeys in active use as of May 2026, with 90% consumer awareness and 75% of consumers having enabled passkeys on at least some accounts. These are adoption curves that look nothing like the smartcard or hardware-token cycles of the 2010s.
Consumer fatigue has reached a tipping point. The average user now manages dozens if not hundreds of accounts, each demanding a unique, complex password, supplemented by a second factor that is itself often phishable — an SMS code, an authenticator app, a backup code printed and lost. The multi-factor authentication layer that was supposed to extend the password's life has instead made consumers acutely aware of how broken the underlying model is. Multi-factor authentication was a tourniquet, not a cure. The fatigue is now a forcing function: users are not just willing to try passwordless methods, they are actively choosing them when offered.
Regulation is applying pressure from the other side. PSD2 in Europe introduced strong customer authentication requirements for payments. NIS2 expanded cybersecurity obligations across critical sectors. The EU AI Act's biometric provisions, which began taking partial effect in 2026, are shaping how identity verification is procured — but the broader regulatory direction is unmistakable: shared secrets are being treated as a liability, and organizations are being told to reduce dependence on them. The regulatory pressure doesn't mandate passkeys specifically, but it makes the status quo increasingly expensive to defend.
For a deeper look at how passkeys work, how they compare to passwords, and what biometric methods exist alongside them, our passwordless vs passkey biometric authentication guide covers the technical and procurement dimensions in detail.
Where Biometrics Fit in the Replacement
Passkeys solve the personal-device login problem comprehensively. They do not solve every authentication problem — and the gap matters.
A passkey is anchored to a device. It works beautifully when the user always has their own phone or laptop. It falls apart on a shared kiosk, a retail POS terminal, a hospital check-in station, a campus turnstile, or an ATM — environments where there is no personal device to hold the credential, and where enrolling dozens of users onto one shared piece of hardware is neither practical nor secure. These are the environments where authentication factors — something you know, have, or are converge differently: the "have" factor (a device) is absent, so the "are" factor (a biometric) becomes the primary credential.
We see this directly in our deployment experience. At Tencent PalmAI, we operate palm recognition systems across 50 million users and 100,000-plus merchants — transit gates, convenience-store counters, hospital check-ins, office building entrances. In every one of these scenarios, the user is interacting with a shared terminal, not a personal device. A passkey cannot run on a turnstile. A password cannot be typed at a checkout counter without destroying the transaction speed that contactless payment was supposed to deliver. The biometric — in our case, palm print and palm vein recognition — is not a convenience layer on top of a device credential. It is the credential, matched against an enrolled identity template, proving that a specific human is present at a shared terminal.
This is the layering that a mature 2026 passwordless stack actually looks like: passkeys for personal-device login, identity-grade biometrics for shared-terminal and high-assurance scenarios. They are not competing technologies. They are complementary layers solving different parts of the same problem — and the passwordless vs passkey buyer's guide maps the decision boundary in detail.
What Still Hasn't Been Solved
The honest version of this article acknowledges that the replacement is not complete, and may never be — at least not in the way the 2004 prediction imagined.
Account recovery remains the hardest problem. Passwords have a built-in recovery mechanism: you reset them. It's clunky, it's exploitable, and it's the vector behind most account takeovers — but it exists. Passkeys, especially device-bound ones, create a new recovery problem: if you lose the device, you lose the credential. Synced passkeys mitigate this by backing up to a cloud account, but that shifts the recovery problem to the cloud account itself, which is typically secured by — a password, or a fallback that is structurally similar to one. The recovery layer is where passwordless systems still carry a piece of the old world.
Cross-ecosystem portability is improving but incomplete. The credential exchange protocol introduced in 2024 allows passkeys to move between Apple, Google, and Microsoft ecosystems. In practice, the experience is still uneven — some services handle the transfer gracefully, others require re-enrollment. For organizations managing thousands of workforce credentials across mixed environments, the portability gap is a real deployment friction point.
The long tail of legacy services will run passwords for years. The 5 billion passkeys in active use is a remarkable number, but it sits alongside a far larger population of services — small businesses, internal tools, legacy enterprise applications, niche SaaS — that have not implemented WebAuthn and may not for years. The password does not die in a single moment. It erodes from the top down: large consumer platforms first, enterprise workforce next, the long tail last. The tail is long.
Shared-device scenarios still lack a universal standard. Passkeys have FIDO. Biometric identity verification on shared terminals does not have an equivalent cross-vendor protocol. Each deployment — whether it's palm recognition, face recognition, or iris scanning — involves vendor-specific enrollment, template management, and terminal integration. This is improving, but the standardization that unlocked passkey adoption has not yet arrived for shared-terminal biometrics.
Where Tencent PalmAI Fits
In the context of this transition, our role is specific: we operate the biometric layer that passkeys can't reach. Our KYCMax platform handles identity verification at scale for enrollment and high-assurance step-up. Our deployments across retail, transit, healthcare, and smart building sectors represent the shared-terminal environments where device-bound credentials don't apply. We're not replacing passkeys — we're the layer underneath them for the scenarios they weren't designed for.
What This Means for Decision Makers
| If you are… | Consider… | Timeline |
|---|---|---|
| A CISO or IT security leader | Defaulting to passkeys for all personal-device logins now; auditing which shared-terminal and high-risk-approval flows need a biometric layer that passkeys can't cover. | Passkey rollout: in progress or next 6 months. Biometric gap assessment: next quarter. |
| A product or identity team | Mapping your authentication surface by device model — personal device vs. shared terminal — and designing the stack so each layer solves the right problem rather than forcing one technology into every scenario. | Architecture review in next quarter |
| A compliance or regulatory lead | Tracking how PSD2, NIS2, and the EU AI Act's biometric provisions affect your authentication obligations — and ensuring your passwordless solutions meet consent, template-handling, and fallback requirements before scaling. | Ongoing through 2026 |
| A KYC or onboarding lead | Evaluating how kyc solutions integrate biometric identity verification into the enrollment flow — so that the "first authentication" (onboarding) and every subsequent authentication share the same identity assurance level. | Evaluation in next 6–9 months |
| A developer or platform builder | Prototyping passkey flows for web and mobile now (the APIs are stable); prototyping shared-terminal biometric flows where your use case requires device-free, person-present verification. | Passkeys: now. Shared-terminal biometrics: pilot in next 6–12 months. |
Frequently Asked Questions
Why has the "password is dead" prediction been wrong so many times?
The prediction was structurally early. Until 2022–2023, the conditions needed for password replacement — a standardized cross-platform protocol (FIDO/CTAP/WebAuthn), platform-level defaults from Apple/Google/Microsoft, browser support, and consumer fatigue strong enough to drive adoption — did not all exist simultaneously. Passwords survived not because they were good but because they were free, universal, and required no coordination. The coordination problem has now been largely solved, which is why this cycle looks different.
Is passwordless authentication the same as passkeys?
No. Passwordless authentication is the umbrella category — any login method that doesn't use a shared secret. Passkeys are one specific method within that category: a cryptographic credential stored on a device and unlocked by a local biometric or PIN. Biometric identity verification on shared terminals is another passwordless method. Our passwordless vs passkey guide explains the distinction in detail.
What are passwordless authentication solutions for shared terminals?
Shared terminals — retail POS, transit gates, hospital check-in, kiosks — cannot use device-bound passkeys because there's no personal device to hold the credential. The passwordless solutions for these environments are server-side biometric systems: palm recognition, face recognition, or iris scanning, where the biometric template is matched against an enrolled identity rather than used as a local unlock gesture. KYCMax is designed for this identity-verification layer.
How do KYC solutions fit into the passwordless transition?
KYC (Know Your Customer) solutions handle the enrollment and identity-verification layer — the moment a user first proves who they are. In a passwordless stack, the KYC flow establishes the biometric template or passkey credential that all subsequent authentications rely on. If the KYC layer is weak, every downstream authentication inherits that weakness, regardless of how strong the passkey or biometric matching is. This is why kyc solutions are increasingly evaluated as part of the authentication architecture, not as a separate compliance function.
Related Resources
- Passwordless ≠ Passkey: A 2026 Buyer's Guide to Biometric Authentication
- Multi-Factor Authentication Explained
- Authentication Factors: Something You Know, Have, or Are — Explained
- Three Years of Palm Payment in China: A Field Read
- KYCMax — Identity Verification Platform
- Industries Overview
About Tencent PalmAI
Tencent PalmAI is an AI-powered palm recognition service combining palm print and palm vein identification into a single contactless act. As the identity layer behind 50 million users across transit, retail, healthcare, and access-control deployments, we operate the shared-terminal biometric verification that passkeys were never designed to cover — and we watch the passwordless transition from the side of the stack where the device is absent and the person must be proven present.
