AI Future Fridays: The Death of the Password

Welcome to AI Future Fridays. Every week this column takes one force shaping the near future, tells you the truth about it, and hands you something to build before Monday. This week: the oldest, most cursed piece of security theater in computing, and the quiet way it's finally getting retired.

Here's the shift that matters. The password turns 65 this year, and for exactly that long it has asked ordinary people to remember a secret, then punished them every way imaginable when they forgot it, reused it, or typed it into the wrong website. That arrangement is ending, and not because a regulator mandated it. It's ending because five billion small cryptographic keys are already living quietly on phones and laptops around the world, doing a job passwords were never built to do.

The Passkey Login Signal

One login shows you the whole shift. Priya is a dental hygienist in Sacramento, and in 2024 a stranger claiming to be from her bank's fraud team nearly talked her into moving four figures to a "safe account" over the phone. The con depended entirely on a password she could be tricked into confirming. This spring she opened her banking app to reset a login she'd forgotten, and found there was nothing left to reset: her face unlocked the app the same way it unlocks her phone, and there was no password anywhere left to guess, phish, or read off a sticky note.

Chase began rolling passkey sign-in out to its banking app this year, alongside a Trusted Contact Person feature that flags high-risk wire transfers, a response aimed squarely at the AI voice-cloning fraud this column covered last Friday, according to reporting from American Banker. Priya didn't request any of it. It just showed up in an app update, and the thing she used to dread most, the password reset flow, simply stopped existing.

The Forecast for Passwordless Login

The honest read on the next 12 to 18 months is that the password is dying unevenly: faster in some corners of your life than others, and the data backs both halves of that sentence. The FIDO Alliance reported this May that passkey awareness has reached 90 percent of people surveyed across ten countries, 75 percent have enabled a passkey on at least one account, and 49 percent already use one regularly when it's offered. That's not early-adopter territory anymore. That's a habit.

And yet the same report found that one in three people (33 percent) experienced an account compromise or received a breach notification in the past year, proof that the old habit is still doing damage on its way out the door. Fifty-seven percent of organizations still lean on password-based methods for employees' primary day-to-day sign-in, which is exactly the kind of exposure that keeps IT teams wiring breach alerts and reset spikes into their own security stack automation rather than watching a help desk queue by hand.

The password isn't being deprecated. It's being outcompeted, one login at a time.

Why the Password Won't Die on Schedule

Passkeys stalled for years on a real problem: a passkey created on an iPhone was largely stuck there, and switching phones or ecosystems meant starting over. Apple, Google, Microsoft, and password managers including Bitwarden spent 2025 building the Credential Exchange Protocol specifically to fix that, and it started shipping in consumer software this year. The lock-in complaint that killed a lot of early passkey pilots is quietly becoming yesterday's problem.

Something bigger changed underneath all of this, and almost nobody noticed. For 19 straight years, stolen credentials sat at or near the top of how attackers broke into networks in Verizon's annual Data Breach Investigations Report. In the 2026 edition, that finally flipped: credential abuse fell from 22 percent of initial access down to 13 percent, while vulnerability exploitation jumped to 31 percent, according to Help Net Security's coverage of the report. Passwords didn't stop being weak. There are just, for the first time in the report's history, fewer of them left worth stealing.

The Backstory of the Computer Password

Every future has a lineage, and this one starts with an afterthought. In 1961, a researcher at MIT named Fernando Corbató was building one of the world's first time-sharing systems, letting several people share one computer instead of waiting in line with punch cards. The problem was that anyone logged in could see everyone else's files. Corbató's fix was a personal password for each account, a small bit of bookkeeping bolted onto a machine that was never meant to hold up a planet's worth of banking, healthcare, and email six decades later.

He lived to see what his fix became. Corbató told the Wall Street Journal in 2014 that he'd found himself juggling more than 150 passwords on his own crib sheet, and that the whole system had, in his words, become a nightmare, a quote Gizmodo preserved after he died in 2019. The inventor of the password spent his last years locked out of his own accounts as often as anyone else.

• 1961: MIT's CTSS introduces the first login password, an afterthought bolted onto a shared machine.
• 1988: The Morris worm spreads across the early internet partly by guessing weak passwords from a short dictionary list, an early lesson nobody fully learned.
• 2017: The Equifax breach exposes 147 million people's records, seeding a decade of stolen-password fraud that outlived the headlines.
• 2026: FIDO's passkey standard crosses 5 billion keys in active use, the first successor with real mainstream traction.

Sixty-five years, one shortcut: a secret you're expected to remember and never reuse becomes the single point of failure for everything that secret unlocks. Only now is a real alternative old enough, and widespread enough, to replace it. The cleanup bill from breaches like Equifax's is a big reason so many companies now wire password-reset floods and credential alerts into their own IT team's automated workflows instead of staffing a help desk to absorb the damage by hand.

The Countermove for Passkey Migration

The same five-minute setup flow that got you into a passkey is the one that gets you the rest of the way out of password habits, and this is where the column earns its cyberpunk streak: you don't wait for every site to force the switch. You wire your own migration, mostly for free, in an afternoon.

Start with the boring, load-bearing moves:

• Turn on passkeys for email and banking first. Those two accounts are what everything else recovers through, so they matter more than the rest combined.
• Keep a password manager for the holdouts. Health portals, that one loyalty site, the sites that haven't added passkeys yet all still need a strong, unique password rather than a memorized, reused one.
• Set up recovery before you need it. A second device or a written recovery code stored safely turns a lost phone from an emergency into an inconvenience.

Then build the fun layer: a little agent that does the tedious auditing for you. Picture a workflow that checks your top accounts for passkey support, flags any password you're still reusing across two or more sites, cross-references your email against known breach lists, and hands you a short weekly to-do list of the biggest remaining gaps. It's the same audit-and-report shape a security team runs for an entire company, just aimed at your own logins instead of a workforce.

That kind of watcher doesn't need to be complicated to earn its keep. The whole job is pattern matching on a schedule: check a list, flag what changed, send a short note. Nobody wants to burn a Saturday morning clicking through forty account settings pages by hand, and with a little automation, nobody has to. The tedious part is exactly the part worth handing off, the same logic behind any plan to automate the parts of a job that are pure repetition instead of judgment. The agent workflow directory already has watch-and-report patterns built on exactly this idea, ready to adapt instead of starting from a blank page.

None of this requires you to know how to code, and that's really the whole point of building it this way. You describe what the auditor should check in plain English, the same way you'd explain the rule to a friend ("tell me which of my top 20 accounts still don't offer a passkey, and flag any password I've used twice"), and that plain description becomes the agent itself. BYOBot turns a plain-English description into a working agent without you touching a line of code.

The Horizon for a Passwordless World

Let yourself see where this goes, because it goes somewhere quietly wonderful. A world built on something you hold instead of something you memorize is a world where the entire category of "I clicked the wrong link and now my life is a mess for six months" starts shrinking. No database of a billion passwords sitting in a criminal marketplace, because there's no shared secret left to steal in bulk. No 3 a.m. panic over which of thirty accounts shares which recycled password. Just a face, a fingerprint, or a PIN, tied to a device that's already yours.

This column's promise stands here too: no future we describe here is worth wanting if it crowds out ending war, halting genocides, or reversing the climate crisis, and this one doesn't; it simply removes a chore. And no future we describe buys its convenience with someone else's freedom. A passkey lives on your device and proves a claim to a server without ever handing your face or your fingerprint to a company, a government, or a watchlist. That's the opposite of a surveillance tool: it's a key that only works because nobody but you can copy it. The same cryptographic handshake that lets your phone vouch for you at your bank is a small, real piece of digital sovereignty, not a new leash, and it's one small corner of the larger shift from generative to functional AI: tools that used to just answer questions are starting to hold the keys and do the quiet, protective work themselves.

Priya's kids won't grow up dreading a password reset email the way she did. They'll just unlock things, the way people have always wanted to.

Before Monday: Your Passkey Migration Checklist

You have a weekend in front of you. Here's what to do with it:

1. Turn on a passkey for your primary email account first, since it's the recovery path for almost everything else you own.
2. Do the same for your bank or credit union if it offers passkeys; check the login settings even if you haven't seen an obvious prompt.
3. Set up a real recovery method (a second device, a backup key, or a written recovery code stored somewhere safe) before you need it, not after.
4. Pick three more accounts you use weekly (shopping, social, work tools) and enable passkeys on any that offer them.
5. For everything that doesn't support passkeys yet, replace any reused password with a unique one from a password manager.
6. Describe your passkey migration audit agent and have it built, so the accounts you missed don't stay missed.
7. Tell one relative about the switch this weekend, especially anyone who'd be a target for the scams this column covered last week.

Frequently Asked Questions

• What exactly is a passkey, and how is it different from a password?+
  A passkey is a matched pair of cryptographic keys instead of a memorized secret. A private key lives only on your device; a public key sits with the service you're signing into. You unlock the private key with your face, fingerprint, or device PIN, and the two keys handshake behind the scenes. There's nothing to type, nothing to phish, and nothing sitting in a breached database for someone to steal.
• Is it safe to rely on Face ID or a fingerprint for something as sensitive as banking?+
  Yes, and in an important way it's safer than a password. Your face or fingerprint never leaves your device and the bank never receives it; the device just uses it to unlock a signed approval. A hacker who breaches a bank's servers walks away with nothing usable, unlike a password database, where one leak can expose millions of reused logins at once.
• What happens if I lose my phone? Do I lose all my passkeys?+
  Not if you set up recovery first. Passkeys sync through your phone's cloud account (iCloud Keychain, Google Password Manager, or a manager like Bitwarden), and the new Credential Exchange Protocol now lets you move them between providers if you switch ecosystems. The agent workflow directory has recovery-audit patterns worth adapting so a lost phone stays an inconvenience, not an emergency.
• Can I use AI to make the switch to passkeys easier?+
  Yes. Checking which of your accounts already support passkeys and flagging the ones still sharing a risky reused password is exactly the kind of repetitive audit work suited to an agent instead of an afternoon of manual clicking, the same shape as any plan to automate repetitive tasks with AI.