The End of the Password
Today, a secret we may no longer need to remember.
The University of Houston presents this series about the machines that make our civilization run, and the people whose ingenuity created them.
_____________________
For thousands of years, people have used secret words to prove who they are. A guard might ask a traveler for a password before opening a gate. Soldiers used secret words to tell friend from enemy.
Computers borrowed the same idea.
When early computer systems needed to decide who could enter, a password seemed simple. The computer stored a secret, and the person trying to enter supplied the same secret. If they matched, the door opened.
Today, passwords are everywhere.
We create them for email, banks, stores, schools, and social media. We’re told to make them long. Don't reuse them. Don't write them down. Don't make them easy to guess.
We've created a strange problem. A good password should be difficult for another person to discover, yet easy for us to remember.
Now engineers are trying something different.
It's called a passkey.
“Digital Lock on Keyboard,” Public Domain Pictures, CC0 Public Domain, AI-generated.
Instead of asking you and a computer somewhere on the Internet to share a secret, a passkey uses two electronic keys. They’re related mathematically, but they do different jobs.
One is called the public key. A website can keep that one.
The other is the private key. It stays under your control.
When you try to sign in, the website sends your device a kind of mathematical puzzle, called a challenge. Your device uses its private key to create an answer. The website checks that answer using the public key it already has. Your private key itself does not have to be sent to the website. This system is based on something called public-key cryptography.
To you, however, all of that mathematics may be almost invisible.
You might simply unlock your device with a fingerprint, your face, or a PIN. The device then handles the cryptographic work needed to sign you in. Passkeys based on FIDO standards are designed to work this way.
“Fingerprint scanner identification,” Rachmaninoff, Wikimedia Commons, CC BY-SA 3.0.
There's another clever part.
A passkey is tied to the website or application where it was created. That makes it resistant to phishing attacks, in which a fake website tries to trick us into giving away a password.
And so we come full circle.
For centuries, security depended on knowing a secret. The password moved from the castle gate to the computer terminal and eventually into our pockets.
But computers can do something the guard at the gate could not. They can use mathematics to let us prove that we hold a secret without giving that secret away.
We may still use passwords for some time. Old technologies rarely disappear overnight.
But someday, perhaps we'll look back at the password and wonder why we spent so much time remembering strange combinations of letters, numbers, and symbols.
Sometimes the best solution to remembering a better password is not having a password at all.
I’m Andy Moon, at the University of Houston, where we’re interested in the way inventive minds work.
(Theme music)
This Episode first aired October 28, 2026.