What Is a Password?

The definition and purpose of a password

A password is a secret string of characters — letters, numbers, symbols — that a person presents to a computer system to prove they are who they claim to be. The system stores a reference (in modern implementations, a cryptographic hash rather than the password itself) and compares the presented string against it. If they match, access is granted. This concept — shared secret as proof of identity — has been used in human institutions for millennia, from military challenge-response codes to speakeasy passphrases. The digital version emerged in the early 1960s.

A brief history of passwords

The first computer password system was developed at MIT in 1961 for the Compatible Time-Sharing System (CTSS), which allowed multiple users to share computing resources. Each user had a private file protected by a password. Even then, security issues emerged quickly — a system bug once printed the entire password file to users by mistake, one of the first documented password breaches in computing history.

Through the 1970s and 1980s, Unix systems standardised password hashing — storing a transformed version of the password rather than the password itself. Ken Thompson and Robert Morris at Bell Labs developed key innovations in this area. The web era of the 1990s brought passwords to a mass audience, and the explosion of online services in the 2000s created the password management problem most people face today: too many accounts, too many passwords to remember.

How a website verifies your password without storing it

Responsible websites do not store your password. Instead, they store a cryptographic hash — the output of a one-way mathematical function applied to your password. When you log in, the website applies the same function to what you type and compares the result to the stored hash. If they match, you are authenticated. The function is one-way: knowing the hash gives no practical way to reconstruct the password.

Modern implementations add salting — a unique random value prepended to each password before hashing — to prevent rainbow table attacks. They also use slow hashing algorithms (bcrypt, scrypt, Argon2) that are deliberately expensive to compute, making brute-force attacks against stolen hashes impractically slow even on specialised hardware.

What makes a password the right tool for the job

Passwords have three properties that made them the dominant authentication method for more than sixty years: they are something only the user knows (theoretically), they require no special hardware, and they can be changed if compromised. No special device is needed, no biometric scanner, no trusted third party to verify your identity. Any two systems that agree on a shared secret can use it for authentication.

The fundamental weaknesses of passwords

Passwords are secrets that must be shared. You tell the website your password; the website stores a reference. Both ends of this exchange are potential attack surfaces. Passwords can be phished — tricked out of users by fake websites. They can be guessed if too simple. They can be stolen if the website stores them poorly. And they can be forgotten, which is why every password system has a password reset mechanism — which itself becomes a high-value attack target.

What is replacing passwords

Passkeys — based on the FIDO2 and WebAuthn standards — are increasingly replacing passwords for new accounts and existing logins. A passkey uses public-key cryptography: a private key stays on your device and never leaves, while a public key is stored on the server. Authentication proves possession of the private key through a biometric or PIN, without any shared secret. The server never learns anything that would be useful to an attacker who stole the database. Passkeys are designed to resist phishing, since the private key will not sign authentication challenges from domains it was not enrolled for. Despite this trajectory, passwords will remain relevant for years to come — both because many systems will not migrate quickly, and because some authentication scenarios genuinely require a shared secret.

Passwords, passphrases and PINs

These terms overlap, and the differences are mostly about length and context. A passphrase is a password made of several words, such as four or five unrelated words strung together. Each added word contributes a good deal of unpredictability, so a randomly chosen passphrase can be both strong and easier to remember than a short string of symbols. A PIN is also a secret in the same family, but it is usually short and numeric, so it normally relies on a device or service limiting the number of attempts rather than on the PIN alone.