From passwords to passkeys: sixty years of signing in

1961: the first passwords

MIT’s time-sharing computer gave each researcher a password to keep their files and computer time separate. Within a year, someone printed the master password file. (Read the story.)

1970s: hiding the password itself

Computer scientists realized systems did not need to store passwords at all. They could store a scrambled version, called a hash, and compare it when someone signed in. In 1979, Robert Morris and Ken Thompson of Bell Labs published a paper on making password storage stronger. Robert Morris’s son would later write the Morris worm.

1990s and 2000s: the second factor

Banks and large companies began giving staff small key-ring tokens that showed a changing number. Signing in needed something you knew and something you had. Text-message codes and phone apps brought the same idea to everyone.

2010s: password reuse becomes the main risk

Huge lists of passwords stolen from websites circulated online. Because people reuse passwords, attackers simply tried them everywhere. Password managers and multi-factor authentication became the standard advice.

Today: passkeys

Attackers learned to phish multi-factor codes too. Passkeys are the next step: your device holds a private key that never leaves it, and it only works on the real website it was made for. A fake sign-in page gets nothing it can use. In 2022, Apple, Google and Microsoft committed to supporting passkeys, and many services now offer them.

What this means for a business

• Every account should have multi-factor authentication today.
• A password manager makes unique passwords practical.
• Passkeys and app-based sign-in are worth adopting wherever your systems support them.