I keep a note in my phone with thirty-seven passwords I’ve forgotten and reset at least twice. Somewhere in that list is the email account I use to reset other passwords, which itself requires a password I’ve definitely written on a Post-it note that may or may not still be stuck to my desk. This is not how anyone intended things to go.
The password was supposed to be temporary. In 1961, a computer scientist at MIT needed a quick way to keep users from reading each other’s files on a shared machine. He built a simple login system, assumed someone would replace it with something better, and moved on. Sixty years later, we’re still using his stopgap—and everyone agrees it’s a disaster.
Passwords have outlived their shelf life, which is why so many people now offload them entirely — Comparisony compares 1Password vs. Bitwarden, and CISA’s Secure Our World guidance covers current password best practices.
The short answer
Passwords were created in 1961 at MIT as a side effect of computer time-sharing. They were never designed to scale to billions of users or protect sensitive data. We’re stuck with them because replacing every password-based system on Earth would require a level of coordination that has yet to happen—though the technology to do so has existed since at least 2019.
The accidental invention: MIT and the first passwords
Fernando Corbató didn’t set out to invent the password. He was trying to solve a scheduling problem.
In 1961, computers were the size of rooms and cost as much as houses. MIT’s Computation Center had one machine—the Compatible Time-Sharing System, or CTSS—and a growing list of researchers who wanted to use it. Corbató’s team built a system that let multiple people log in at once, each with their own files and settings. The problem: anyone could open anyone else’s files just by typing the right command.
The solution was obvious and inelegant. Each user would pick a four-to-six-character word. The system would ask for it at login. If you typed the right word, you got in. If you didn’t, you didn’t.
These first passwords were stored in plain text on the machine’s disk. No encryption, no hashing, no expiration dates. This wasn’t carelessness—the computer lived in a locked room, accessible only to a small group of trusted researchers. The idea that millions of strangers would someday use passwords to access bank accounts from coffee shops would have sounded like science fiction.
Before computers: When secrets needed protecting
The concept of a secret phrase granting access is older than CTSS by a few thousand years. Roman soldiers used signums—daily passwords—to identify each other at night. Medieval castles had challenge-and-response phrases to verify messengers. Cold War military communication relied on one-time pads and classified codes.
But computer passwords were different in one critical way. A Roman soldier’s signum changed daily and was only shared among a small group. A computer password, once set, could sit unchanged for months or years—and the system had to remember it for every user, all the time. That meant storing secrets in a way that was both accessible (the computer needed to check them) and secure (no one else should see them). Those two goals turned out to be nearly impossible to balance.
How systems learned to hide what they knew
The plaintext approach MIT used in 1961 worked fine until computers started talking to each other. Once passwords traveled across networks or lived on shared systems, storing them unencrypted became untenable. Anyone with access to the password file had access to every account.
The solution was hashing—a one-way mathematical function that scrambles a password into gibberish. When you log in, the system hashes what you type and compares it to the stored hash. If they match, you’re in. If someone steals the password file, they get a list of scrambled nonsense that’s theoretically impossible to reverse.
The evolution happened in stages. Early Unix systems used DES-based hashing in the 1970s. By the 1990s, MD5 became common. Both were later cracked by faster computers and smarter techniques. Modern systems use deliberately slow algorithms—bcrypt, scrypt, Argon2—that make automated guessing prohibitively expensive. A leaked password database from 2025 is far harder to exploit than one from 1995, even if the passwords themselves are identical.
This technical progress bought time. It didn’t solve the underlying problem: humans still had to create, remember, and type the passwords in the first place.
The moment everything broke: The Morris Worm and password creation rules
For two decades, passwords hummed along quietly. They weren’t perfect, but they worked well enough for universities and research labs. Most people didn’t have a computer. The ones who did treated passwords like they treated office keys—simple, memorable, rarely changed.
Then came November 2, 1988.
A graduate student named Robert Tappan Morris released a worm—a self-replicating program—onto the early Internet. It wasn’t meant to be destructive; Morris later said he wanted to measure the size of the network. But the worm had a bug. It spread faster than intended, infecting roughly 6,000 computers—about ten percent of the Internet at the time—and grinding many of them to a halt.
The worm’s success came down to passwords. It exploited weak and reused passwords on Unix systems, guessing common words and phrases until it found a match. The breach exposed what security experts had quietly worried about for years: passwords that worked fine in a locked room became catastrophic vulnerabilities at scale.
The response was swift and, in hindsight, misguided. Institutions began mandating “strong” passwords: at least eight characters, mixing uppercase and lowercase letters, including numbers and symbols, changed every 90 days. In 2003, the National Institute of Standards and Technology formalized these rules in official guidance. Banks, email providers, and workplaces adopted them as gospel.
The theory was sound. The practice was a mess. Users, forced to create passwords they couldn’t remember, did exactly what you’d expect: they wrote them on Post-its, reused slight variations across accounts (Password1, Password2, Password3), and substituted characters in predictable ways (@ for a, 3 for E, ! at the end). Security decreased. Frustration increased.
The rule that backfired
In 2017, NIST did something unusual for a government standards body: it admitted it was wrong.
The agency’s updated Digital Identity Guidelines (SP 800-63B) explicitly recommend against the same complexity and expiration rules it had endorsed fourteen years earlier. No more mandatory symbols. No more forced 90-day resets. The guidance now says what security researchers had been arguing for years: frequent password changes encourage weaker passwords, and predictable character substitutions are trivial for modern cracking tools to defeat.
The better approach, NIST found, was longer passphrases made of random words—easy for humans to remember, exponentially harder for computers to crack. “Correct horse battery staple” beats “P@ssw0rd!” by every measure that matters. The shift represented a rare case of policy catching up to evidence, acknowledging that the old rules had actively made systems less secure.
But by then, millions of systems were already built around complexity requirements. Changing them would mean retraining users, updating legacy software, convincing security teams to abandon standards they’d enforced for years. Hardly anyone did. We knew the rules were broken. We kept following them anyway.
What’s replacing passwords—slowly
The irony is that working alternatives to passwords have existed for over a decade. We’ve just been terrible at adopting them.
Multi-factor authentication became widespread in the early 2010s—text codes, authenticator apps, the extra step that proves you have both the password and the physical device. It helped, but it didn’t remove passwords; it just added a second layer.
The real shift started in 2013 with FIDO (Fast Identity Online) and Universal 2nd Factor (U2F)—standards for hardware security keys that authenticate you without a password ever crossing the network. Google deployed U2F internally that year and saw account compromises drop to nearly zero.
In 2019, the W3C formalized WebAuthn, a web standard that lets sites verify your identity using cryptographic keys stored on your device—your phone, laptop, or a dedicated hardware key. Instead of typing a password that could be stolen, you prove you possess a device that holds a private key that never leaves the hardware. The server only stores a corresponding public key, useless if stolen.
By 2024, Apple, Google, and Microsoft had built passkey support directly into their operating systems, letting users log in with a fingerprint or face scan instead of typing anything. The technology works. It’s more secure than passwords. It’s available right now on most new devices.
And it’s still not universal. Legacy systems don’t support it. Many users don’t know it exists. Websites that do offer passkeys often bury the option three menus deep or keep passwords as a fallback, which negates half the security benefit. We’re in the awkward middle phase where the replacement exists but the old system refuses to die.
FAQ
When were passwords first created?
The first computer passwords appeared in 1961 on MIT’s Compatible Time-Sharing System (CTSS). Earlier forms existed in military and diplomatic contexts, but the modern password as a login credential originates with CTSS.
Who invented the password?
Fernando Corbató and his team at MIT’s Computation Center developed the password system for CTSS. Corbató has said it was meant as a temporary fix, not a permanent solution.
What was the first computer password?
There’s no record of the literal first password typed into CTSS. The system allowed four-to-six-character passwords stored in plain text, but individual user choices weren’t documented.
Why do we still use passwords if they’re insecure?
Path dependence. Once millions of systems were built around passwords, switching to alternatives became prohibitively expensive and logistically complex. Replacing them would require coordinated action across industries, device manufacturers, and billions of users—even though the technology to do so has existed since at least 2019.
How have password rules changed over time?
Early passwords were short and simple. After the 1988 Morris Worm, complexity rules became standard: uppercase, numbers, symbols, regular changes. In 2017, NIST reversed course, recommending longer passphrases instead and dropping forced expiration. Many systems still use the old rules.
What are passkeys and how do they work?
Passkeys use public-key cryptography stored on your device to verify your identity without transmitting a secret. You authenticate with a fingerprint or face scan; the device proves possession of a private key without ever sending it across the network. The W3C standardized the technology in 2019 as WebAuthn.
The password will eventually disappear. Passkeys are creeping into operating systems. Biometrics are normalizing. But “eventually” has meant “five years away” since 2015, and I’m not holding my breath. In the meantime, I’ve got another password reset email to deal with.