There is something deeply human about the idea of a secret word. A phrase known only to those who belong, whispered at a door, carved into a tablet, or typed into a box on a screen — the password, in all its forms, has been one of humanity’s most persistent and adaptable security tools. We tend to experience passwords today as a source of mild frustration at best and a genuine security nightmare at worst, but that experience sits at the end of a remarkably long and surprisingly rich history. The password did not arrive with the internet or even with the computer. It arrived with civilization itself, born from the same fundamental human need that drives all security thinking: the need to know who to trust. To understand why passwords work the way they do today — and why they so often fail — it helps enormously to understand where they came from. And that story begins not in a server room but on an ancient battlefield.

The earliest documented use of something recognizable as a password takes us back to the ancient Near East, more than three thousand years ago. In the biblical Book of Judges, dated to around the 12th century BCE, there is a brief but extraordinary account of a military security measure deployed by the Gileadites after a battle against the Ephraimites. The two groups spoke the same language but different dialects, and that difference became the basis for one of history’s first recorded identity verification systems. The Gileadites controlled the crossing points of the Jordan River, and any person seeking to cross was asked to say a single word: “shibboleth.” To the Gileadites, this was a straightforward request. To the Ephraimites, it was an impossible one — their dialect did not include the “sh” sound, and they could only produce “sibboleth” instead. That single mispronounced syllable was enough to mark them as enemies. What makes this account so compelling from a security perspective is not just that it is old, but that the security mechanism being used is genuinely sophisticated. The Gileadites were not relying on what someone claimed to know but on something far harder to fake — an involuntary physical characteristic of how they spoke. They had, in essence, invented a form of biometric authentication millennia before the concept had a name. The word “shibboleth” has since entered general usage to describe any custom or practice that distinguishes one group from another, but its origins as a security tool remain one of the most striking early examples of password thinking in recorded history.

From the ancient Near East, the concept of the secret word spread and evolved across civilizations, each adapting it to their own security needs and social structures. The ancient Romans developed what is arguably the most sophisticated pre-modern password system that we know of in any detail. The Roman military, famously disciplined and procedurally rigorous, used a system of spoken watchwords that went far beyond simply knowing a phrase. Each evening, a designated soldier from each unit would make their way to the tent of the commanding tribune and receive the night’s watchword inscribed on a small wooden tablet. This tablet — known as a tessera — would then be passed along the chain of command with strict accountability at every step. All tesserae were required to be returned before dark, and any tablet that failed to complete its circuit triggered an immediate investigation. The consequences for failure were real and swift. What the Romans had built, essentially, was a credential system with full audit trails, regular rotation, and enforced accountability — principles that any modern cybersecurity framework would recognize immediately. The watchword itself changed daily, ensuring that even a compromised credential had a very short window of usefulness. The Romans also used tesserae in civilian contexts, issuing physical tokens to citizens entitled to specific goods or services, functioning in much the same way as a modern access card or government-issued ID. The sophistication of this system, operating in the centuries before the common era, is a useful reminder that the challenges of managing credentials at scale are not a product of the digital age. They are a product of organized society itself.

Julius Caesar added a further dimension to this picture with his use of cryptographic encoding to protect the content of communications rather than simply the access to them. The cipher that bears his name involved shifting each letter of the alphabet by a fixed number — typically three — so that plain text became unreadable to anyone who did not know the key. A becomes D, B becomes E, C becomes F, and so on through the alphabet. It was not a password in the strictest sense, but it embodied the same core principle: information is only protected when it is presented in a form that is meaningless to those who lack the key to decode it. The Caesar cipher was effective in its context largely because most people were illiterate and the practice of cryptanalysis was essentially nonexistent. By modern standards it would take seconds to break. But as a conceptual contribution to the history of authentication and access control, it was significant. Caesar understood that security was not just about who could approach a gate, but about what could be understood by those who intercepted a message along the way. That insight — protecting information at the content level, not just the access level — runs directly through to modern encryption.

The medieval period brought passwords firmly into the architecture of physical fortification, where they became a standard element of castle and garrison security across Europe. Gaining entry after dark required knowing the correct spoken phrase, and these were typically rotated on a regular schedule, shared only with guards, commanders, and a carefully limited circle of trusted individuals. The wooden gates and stone walls of a medieval castle were impressive physical barriers, but the spoken password was the layer of security that governed who could move through them after nightfall when visual identification was impossible. Shakespeare captured this world in Hamlet, where a guard identifies himself by knowing the password “Long live the king” — a detail included with such matter-of-factness that it confirms the practice was entirely familiar to Elizabethan audiences. What is also notable about the medieval password is where its weaknesses lay: the phrase was often too obvious, shared too broadly, and changed too infrequently to provide genuinely robust security. These are not problems that disappeared with the drawbridge. They are exactly the same problems that make modern password hygiene so difficult to enforce.

One of the most culturally vivid chapters in password history comes not from a battlefield but from a speakeasy. During American Prohibition in the 1920s, when the sale and consumption of alcohol was federally illegal, underground bars operated throughout American cities using passwords as their primary means of controlling who could enter. A potential patron would approach an unmarked door, knock in an agreed pattern, and whisper a pre-arranged word or phrase to whoever answered. Get it right and you were in. Get it wrong and the door stayed shut. The speakeasy password served a dual function that is worth noting: it was both a security mechanism and a social ritual, one that gave its users a sense of belonging to something exclusive and slightly dangerous. That psychological dimension — the idea of the password as a marker of insider status — is something that carries forward into the digital world in ways that are not always immediately obvious. The speakeasy era also illustrated something important about password security in practice: the system worked until it didn’t, and it stopped working because the human element proved impossible to fully control. Passwords leaked, informants existed, and the exclusive knowledge that was supposed to be tightly held spread in ways that were difficult to track or prevent. A lesson that the history of digital passwords would repeat, loudly, many times over.

The transition from physical to digital passwords happened in 1961, at the Massachusetts Institute of Technology, and the story behind it is both more modest and more consequential than most people realize. A computer scientist named Fernando Corbató was working on a large time-sharing system called the Compatible Time-Sharing System, or CTSS, which allowed multiple researchers to access the same mainframe computer remotely. The problem was straightforward: each user had their own files and their own work, and there was no mechanism to keep those files private from other users on the same machine. Corbató’s solution was equally straightforward — give each user their own password. His goal, by his own account, was not high security but basic compartmentalization. He wanted to give people a reasonable expectation of privacy in a shared environment, not to build an impenetrable fortress. And in that modest ambition, he created something that would eventually become one of the most used and most problematic technologies in human history. Corbató went on to win the Turing Award in 1990 for his broader contributions to computing. In later life, he described the proliferation of passwords as having become a genuine nightmare, and admitted to keeping a written log of his own passwords — a habit shared by a significant proportion of the global population, though rarely discussed openly. The father of the digital password, it turns out, had the same password problem as the rest of us.

What happened almost immediately after Corbató’s system went live was both entirely predictable in retrospect and historically significant. Within a very short time, a software bug caused the entire password file for the CTSS to be printed out and made visible to users. The world’s first digital password system had produced the world’s first digital data breach. A graduate student, having had his access privileges reduced, obtained a printed list of all system passwords and used them to continue accessing resources that were no longer his to use. History’s first password hack had occurred before the system was even a year old. These events were small in scale and consequence by modern standards, but they established a pattern that has repeated itself with devastating regularity ever since: passwords stored insecurely, credentials obtained through privilege misuse, and a fundamental gap between the security a system was designed to provide and the security it actually delivered.

Through the 1970s, serious computer scientists began working on ways to address the structural weaknesses of password storage. The most important development of this period was the invention of hashing — a cryptographic process by which a password is transformed into a fixed-length numerical code before it is stored, so that even if someone gains access to the file where passwords are kept, they see only the hash rather than the original text. Robert Morris Sr., working at Bell Labs, was a key figure in this development, and hashing became a foundational element of how passwords were stored across systems from that point forward. It did not solve the human problem — people still chose weak passwords, still reused them, still wrote them down — but it represented a genuine technical advance in protecting credentials at rest. The 1980s brought growing public awareness that password complexity mattered, and the idea of a strong password began to make its way into mainstream consciousness, even if the mainstream responded by adding a capital letter to a pet’s name and calling it done.

The 1990s changed everything, in the way that the internet changed everything. The sudden explosion of online accounts — email, banking, shopping, forums, social networks — meant that the average person went from managing a handful of passwords to managing dozens, and eventually hundreds. The credential management challenge that Corbató had encountered in a shared computer lab in 1961 had now been distributed to every household with a telephone line and a modem. In 2003, the US National Institute of Standards and Technology published guidelines that shaped password policy across the internet for the next two decades, recommending complexity requirements including uppercase and lowercase letters, numbers, and special characters. These guidelines were well intentioned and widely adopted — and their unintended consequences have been significant. Research has consistently shown that mandatory complexity requirements tend to drive people toward predictable patterns: passwords that technically meet the requirements but are still easily guessable, like “Password1!” or “Summer2023.” The gap between the password as a security concept and the password as a lived human behavior had never been more obvious.

Today that gap is the central problem of password security, and the industry is responding in ways that would have been unrecognizable to Corbató. Two-factor authentication — requiring not just a password but a second proof of identity, such as a code sent to a phone — has become standard across most major platforms, adding a layer of security that compensates for the inherent weakness of the password alone. Biometric authentication has brought the logic of the Gileadites’ shibboleth into the smartphone era, using fingerprints, facial recognition, and voice patterns to verify identity through physical characteristics rather than remembered information. Password managers generate and store credentials of a complexity that no human could reasonably memorize, allowing each account to have a genuinely unique and genuinely strong password without the cognitive burden of remembering it. And increasingly, the technology industry is exploring the possibility of eliminating the traditional password altogether through the use of passkeys — cryptographic credentials tied to a specific device that authenticate a user without requiring them to type anything at all.

The password has survived for more than three thousand years because it solves a problem that never goes away: the need to verify that the person seeking access is who they claim to be. From a riverbank in ancient Canaan to a speakeasy door in 1920s Chicago to a login screen in 2026, the question being asked is always the same. What has changed is the scale, the sophistication, and the stakes. The modern internet processes billions of authentication events every single day, and the consequences of a compromised credential now extend far beyond a castle gate left unguarded or a night’s free computing time. Yet the fundamental human challenges — remembering, sharing, choosing, and protecting — remain as stubbornly present as they were when a Gileadite soldier asked a stranger to say a single word and listened very carefully to how they said it. The technology evolves. The human element does not. And that, more than anything else, is what three thousand years of password history has to teach us.