Imagine leaving home with no wallet.
No driver’s licence. No credit cards. No collection of passwords whose security strategy consists of adding !2026 to the end of the same word you have been using since 2012.
You walk into a store, touch a fingerprint reader and pay. You arrive at the airport, touch another reader and prove your identity. You log into your bank by touching your laptop. You rent a car, enter a bar, sign a mortgage and access your medical records the same way.
One finger to rule them all.
At first glance, it sounds wonderfully obvious. Our fingerprints are unique. We carry them everywhere. We cannot forget them in an Uber. And unlike passwords, nobody has ever needed a sticky note under the keyboard reminding them what their index finger is.
So why do we still carry documents, cards and passwords?
After looking at the security standards, payment systems, digital-ID programs and biometric research, I came to a slightly counterintuitive conclusion:
We absolutely should use fingerprints to eliminate much of the friction of passwords, cards and physical IDs. But we should never make the fingerprint itself the universal credential.
The distinction sounds technical. It is not.
It is the difference between a remarkably elegant digital future and an enormous biometric surveillance database that cannot issue you a new finger after a breach.
And, interestingly, the technology industry has already begun converging on the better model.
Your fingerprint is not actually an identity
The easiest mistake is to treat three different concepts as if they were the same thing:
Identity
A credential
Authentication
They are not.
Your driver’s licence is a credential issued by a government. It contains claims: your name, date of birth, photograph, licence class and expiry date. More importantly, the issuing government can revoke or change those claims.
Your credit card is another kind of credential. It connects a payment transaction to an account through a payment network and issuer.
Your password is primarily an authenticator. It is supposed to prove that the person attempting to access an account is the person authorized to use it.
A fingerprint is also primarily useful for authentication.
It answers something like:
“Does the person touching this sensor match the person who enrolled this fingerprint?”
It does not answer:
Are you over 19?
Are you legally permitted to drive?
Has your licence been suspended?
Which bank account should pay for this coffee?
Has the credit card account been closed?
Are you currently licensed to practise medicine?
Your index finger, talented though it may be, has never passed a road test. Visa has also never extended it a line of credit.
This distinction appears explicitly in biometric standards. NIST distinguishes biometric verification, a one-to-one comparison against a claimed identity, from identification, where a biometric is searched against many enrolled identities. NIST’s definition of one-to-one biometric verification
That distinction becomes critical once we start designing a digital identity system.
The password experiment has gone badly enough already
If there is one part of our current identity infrastructure that deserves retirement, it is the password.
Passwords are a bizarre historical artifact. Computers are extremely good at remembering long random numbers, yet for decades we decided humans should do the remembering instead.
Microsoft reported in 2024 that its identity systems were seeing more than 4,000 password attacks per second, up from roughly 115 per second in 2015. Microsoft’s analysis of the password problem
The replacement is increasingly the passkey.
A passkey does not work by sending your fingerprint to Google, Microsoft or your bank. Instead, your device holds a cryptographic private key. The service holds the corresponding public key. When you log in, your phone or computer proves that it possesses the private key.
Your fingerprint simply gives the device permission to use it.
That architecture matters enormously.
Under the FIDO Alliance passkey model, biometric processing remains on the device. The website receives confirmation that authentication succeeded, not your fingerprint.
The standards underneath this model are WebAuthn and FIDO2. In August 2026, the W3C published Web Authentication Level 3 as a W3C Recommendation, continuing the move toward public-key credentials scoped to particular services rather than reusable shared passwords.
That last part is beautiful from a security perspective.
A password such as Fluffy!2026 can be stolen from one website and tried on twenty others.
A WebAuthn credential created for one relying party is scoped to that relying party. Your bank’s credential is not your Google credential, even though you may unlock both with exactly the same finger.
The human experience feels universal.
The cryptography underneath it deliberately is not.
And people are actually finding it easier
Security people have spent decades telling us that greater security inevitably requires more suffering.
Apparently not.
Google published data from roughly 100 million authentication events in 2023 and found that a successful passkey sign-in averaged 14.9 seconds, compared with 30.4 seconds for passwords. Its same-device passkey authentication success rate was 63.8%, compared with 13.8% for the password flows measured in that dataset. Google’s passkey usability research
Because that was early rollout data, a more mature dataset is even more interesting.
The FIDO Alliance’s 2025 Passkey Index aggregated results from companies including Amazon, Google, Microsoft, PayPal, Target and TikTok. Among participating companies, passkey authentication averaged 8.5 seconds versus 31.2 seconds for other authentication methods, with a 93% success rate versus 63%. Participants also reported an 81% reduction in login-related help-desk incidents. FIDO’s 2025 Passkey Index results
FIDO is obviously an advocate for the technology it helped create, so its numbers should not be treated like a randomized clinical trial. But the direction is difficult to ignore, particularly because Microsoft and Google have reported similar results independently.
By May 2026, FIDO estimated that around 5 billion passkeys were in use worldwide. Its survey of 11,000 consumers across ten countries found that 75% had enabled a passkey on at least one account. The State of Passkeys 2026
FIDO CEO Andrew Shikiar summarized the appeal nicely: passkeys offer “authentication that is both more secure and easier to use.”
That combination is much rarer in technology than product managers like to admit.
So why not send the fingerprint itself?
Because your fingerprint has one unfortunate security property.
You leave copies of it everywhere.
NIST’s current Digital Identity Guidelines make this unusually explicit:
“Biometric characteristics do not constitute secrets.”
A password is supposed to exist only in your head and whatever password manager you trust.
A fingerprint exists on your coffee cup.
Your phone.
A glass door.
The shiny conference-room table someone inexplicably purchased despite knowing humans have fingers.
NIST therefore does not recommend treating a fingerprint as an independent universal password. Its current guidance says biometrics should be used as part of multifactor authentication involving a physical authenticator. It also requires an alternative non-biometric authentication method.
That is approximately what modern smartphones do.
Apple’s Touch ID architecture, for example, does not store a photograph of your fingerprint. It generates a mathematical representation protected by the Secure Enclave. Apple says the biometric data is inaccessible to apps, is never stored on Apple servers and is not backed up to iCloud. How Apple protects Touch ID data
This is not merely an implementation detail.
Keeping biometrics local is the privacy feature.
Because you cannot reset your finger
Suppose Amazon loses your password.
Annoying.
You reset it.
Suppose your bank card gets compromised.
The bank cancels it and issues another number.
Suppose a cryptographic key is compromised.
The credential can be revoked and a new key generated.
Now suppose the master database containing your fingerprint template is stolen.
Customer support cannot email you:
“Sorry for the inconvenience. Please choose a new index finger.”
We already have a rather unpleasant real-world example.
In the 2015 breach of the U.S. Office of Personnel Management, attackers compromised background-investigation information involving roughly 21.5 million people. Approximately 5.6 million records contained fingerprints. The U.S. GAO report on the OPM breach
That incident should permanently end the idea that the safest architecture is a gigantic centralized biometric database.
The problem is not that biometrics are useless.
The problem is that biometrics are extremely valuable and difficult to revoke.
That makes centralization particularly dangerous.
Fingerprints aren’t perfectly deterministic, either
There is another misconception: computers do not examine fingerprints and receive a divine message saying, “Yes, this is definitely Ulad.”
Biometric matching is statistical.
NIST currently requires compliant authentication systems to operate with a false-match rate of one in 10,000 or betteracross relevant demographic groups and recommends a false non-match rate below 5%. NIST also discusses presentation-attack detection designed to detect fake biometric samples.
Apple publishes a stronger figure for Touch ID: it estimates the probability that a random fingerprint could match an enrolled fingerprint at approximately 1 in 50,000 for one enrolled finger. Apple’s Touch ID security figures
Excellent?
Yes.
Magic?
No.
And real fingers have the irritating habit of participating in real life. Apple notes that moisture, sweat, lotions, cuts and dry skin can interfere with fingerprint recognition. Apple’s 2026 Touch ID troubleshooting guidance
So the future probably still needs fallback mechanisms unless we plan to tell someone who sliced a finger while cooking that their bank account will become available once the wound heals.
Credit cards demonstrate the right architecture perfectly
Payments are perhaps the clearest example of why “fingerprint instead of credit card” is slightly the wrong idea.
What we actually want is:
fingerprint instead of cardholder verification, plus a safer digital credential instead of exposing the card number.
Modern digital wallets already work this way.
When you pay with Apple Pay, your fingerprint or face can authorize the transaction. But your fingerprint does not travel through the Visa or Mastercard network.
Instead, a payment credential stored in the device’s Secure Element is used.
Apple says full card numbers are not shared with merchants. A device-specific account number and transaction-specific security information are used instead. Apple Pay’s payment security architecture
Payment networks are moving in the same direction through tokenization.
Visa describes payment tokenization as replacing the 16-digit primary account number with a digital token. Visa currently says around 50% of its e-commerce transactions are tokenized, and reports a 39.4% lower fraud rate for tokenized credentials compared with non-tokenized credentials. Those are Visa’s own network statistics, so they deserve the appropriate vendor-data caveat, but they illustrate the architecture. Visa’s current tokenization data
Now add biometric authentication.
Visa Payment Passkey allows consumers to confirm online payments using a fingerprint, face or device PIN rather than passwords or SMS codes. Visa Payment Passkey
Mastercard offers a similar payment-passkey model. Mastercard Payment Passkey
Notice what neither company is doing.
They are not replacing your bank account with your fingerprint.
The fingerprint unlocks permission to use a cryptographically protected payment credential.
That is far safer.
We even tried putting fingerprint sensors directly on credit cards
For anyone thinking, “Fine, but couldn’t my finger literally replace the PIN on the plastic card?” — the industry thought of that too.
Visa began commercial pilots of fingerprint-sensor payment cards in 2018. A fingerprint template was stored on the card, and the sensor authenticated the cardholder locally. Visa’s biometric payment-card pilot
The concept hasn’t disappeared. EMVCo—the organization behind global EMV payment specifications—was still developing dedicated testing and performance requirements for biometric payment cards in 2025 and 2026. EMVCo’s biometric-card work
But even the literal fingerprint card proves the larger point.
The fingerprint authenticates you.
The card still contains the payment credential.
Driver’s licences are headed in the same direction
Physical identity documents have an even bigger problem than credit cards.
They overshare.
Imagine a bartender wants to know whether you are old enough to buy a beer.
You hand over your driver’s licence.
Congratulations. To prove a single Boolean value — age >= legal drinking age — you may have just revealed your full name, exact birthday, address, photograph and licence number.
From a privacy perspective, this is ridiculous.
Digital credentials can do much better.
The ISO/IEC 18013-5 standard defines interfaces for mobile driving licences and mechanisms for authenticating their origin and integrity. ISO’s mobile driving licence standard
Apple’s implementation already allows eligible users to present licence information from Wallet and approve disclosure with Face ID or Touch ID. Apple notes that the requested information is shown before consent. How IDs in Apple Wallet are presented
Again:
The fingerprint is not the licence.
The fingerprint unlocks the licence.
That means the government can update or revoke the credential without replacing your fingers.
It also creates an opportunity for selective disclosure.
Rather than telling a nightclub your birthday, the credential could simply prove that you are over 19 or over 21.
Europe is moving aggressively toward exactly this model.
Under the European Digital Identity Wallet initiative, EU member states are required to make digital identity wallets available by the end of 2026. The architecture is intended to let people store and share digital credentials while controlling which information is disclosed.
The EU’s age-verification system goes even further: it is designed to prove that someone exceeds an age threshold without revealing their exact age, identity or other personal details. The EU age-verification approach
That is a fundamentally better product than photocopying a passport and uploading it to some random website’s compliance vendor.
The privacy nightmare would be using the fingerprint as the universal identifier
Now imagine we ignore all of these architectural lessons.
Every bank stores your fingerprint.
Every retailer stores your fingerprint.
Every government agency stores your fingerprint.
Your airline has it.
Your employer has it.
Your insurance company has it.
Your hotel has it.
Your gym has it, presumably because society finally decided scanning a QR code was too exhausting.
We would have created the ultimate cross-service tracking identifier.
Passwords can be different for every site.
Passkeys are deliberately different for every service.
Payment tokens can be restricted to particular devices or merchants.
Digital credentials can selectively disclose particular attributes.
But you have approximately ten fingerprints and were issued the original set at birth.
The Federal Trade Commission has specifically warned that large biometric databases are attractive targets and that biometric systems can introduce privacy, security, discrimination and surveillance risks. The FTC’s warning on biometric information
The worst possible biometric future is therefore the one that superficially sounds simplest:
one fingerprint stored everywhere.
Simple user experience. Catastrophic security architecture.
Product managers should recognize this pattern. Sometimes complexity should be removed from the user interface, not from the underlying system.
The much better future has three layers
The architecture I would bet on looks like this.
Layer 1: The credential
Governments issue digital identity credentials.
Banks issue payment credentials.
Employers issue employment credentials.
Universities issue educational credentials.
Services issue account credentials.
These credentials are cryptographically verifiable and, critically, revocable.
Layer 2: Cryptographic keys
Instead of presenting reusable secrets, your device proves possession of cryptographic keys.
Different services receive different credentials or tokens.
A breach at Retailer A therefore does not hand attackers the universal key to Bank B.
Layer 3: The biometric
Your fingerprint, face or another local biometric tells the trusted device:
Yes, I authorize this credential to be used.
The biometric template stays inside secure hardware whenever practical.
That architecture provides almost exactly the magical experience we imagined at the beginning.
Touch your phone to log in.
Touch to pay.
Touch to prove your age.
Touch to rent a vehicle.
Touch to approve a government transaction.
But underneath that single gesture, completely different cryptographic credentials are being used.
To the human, everything feels like a fingerprint.
To the infrastructure, the fingerprint is almost irrelevant.
That is excellent security design.
Approach
Convenience
Phishing resistance
Revocable
Privacy
Password
Poor
Poor
Yes
Moderate
Fingerprint stored centrally everywhere
Excellent
Mixed
Effectively no
Terrible
Physical card/ID
Moderate
N/A
Yes
Often overshares
Passkey/digital credential unlocked by local biometric
Excellent
Strong
Yes
Potentially excellent
There is one more problem nobody should ignore: recovery
Every futuristic identity demo looks wonderful until someone drops their phone into the Pacific Ocean.
Then the demo ends and customer support begins.
A credible digital-identity future therefore cannot merely solve authentication. It has to solve recovery.
What happens when a device is lost?
What happens when someone changes ecosystems?
What happens when a person cannot use the enrolled fingerprint?
What happens after a serious injury?
What happens when an elderly person forgets the backup PIN?
What happens when an attacker controls the victim’s email account and attempts account recovery?
This is arguably the least glamorous and most important product problem in passwordless identity.
A beautifully phishing-resistant passkey system paired with a “forgot everything? click the link we emailed you” recovery process can reintroduce the very weakness the passkey eliminated.
Security is defined by the weakest recovery path, not the nicest authentication animation.
The wallet probably disappears. The credentials do not.
So will we eventually stop carrying driver’s licences, credit cards and memorizing passwords?
I think the answer is largely yes.
Passwords are already entering the early stages of technological retirement.
Credit-card numbers are increasingly being hidden behind device-specific and merchant-specific tokens.
Driver’s licences and government documents are beginning to become cryptographically verifiable mobile credentials.
Biometrics will make all of these systems dramatically easier to use.
But the future is unlikely to be:
“My fingerprint is my password, credit card and driver’s licence.”
It will be something much smarter:
“My fingerprint privately authorizes my device to use the right digital credential for this particular transaction.”
That sentence is less catchy.
Unfortunately, good security architecture rarely fits on a billboard.
And that brings us to the deepest lesson in all of this.
For decades, computers made humans behave like computers. We memorized arbitrary character strings, typed account numbers, copied six-digit codes between applications and repeatedly disclosed far more personal information than a transaction actually required.
The next generation of identity systems can reverse that relationship.
Let computers remember cryptographic keys.
Let governments and banks issue revocable digital credentials.
Let wallets disclose only the information actually required.
Let secure hardware protect the secrets.
And let the human do the one thing humans are uniquely qualified to do:
Show up as themselves.
A fingerprint can make that experience almost invisible.
It just shouldn’t become the database key connecting our entire lives.
Your fingerprint should be the key that unlocks your digital wallet—not the document inside it.
Or, put even more simply:
Biometrics should be the user interface. Cryptography should be the security. Digital credentials should be the identity.
That is how we can finally kill the password without accidentally creating something worse.