Most incidents still start with something everyone knows and everyone knows can go wrong: accounts and passwords. It is basic hygiene that has been the subject of reports for years and that, in reality, barely improves.

Security specialists know this better than anyone, of course. But even within security teams, the management of accounts and passwords is often less in order than we dare to admit out loud. Not because professionals are unaware of the risks, but because the number of digital identities has become unmanageable and maintaining them has been left entirely to individuals.

In this article, I explain why the real solution lies in taking the human factor out of the equation. Passwords need to disappear into the technology, into systems that automatically provide strong, unique access without users having to give it a second thought: that is the path to lasting digital security.

Problem 1: The number of digital identities has become unmanageable

Anyone who tries to map out their own digital “life” is quickly overwhelmed by the sheer number of accounts they have built up over the years. I personally have 402 accounts in my password manager, for example. The average professional has dozens to hundreds of accounts, spread across work, personal life, old hobbies, forgotten services and tools that were needed just once. That number keeps growing, with no cleanup ever to offset it.

The large number of accounts creates a fundamental visibility problem. Most people no longer even know where they have an account, let alone which passwords or access rights belong to which service. Even organizations struggle to map this out for their employees, especially when shadow IT, temporary tools and trial subscriptions pile up.

Moreover, an account does not stand on its own. It contains personal data, preferences, sometimes even financial data or access to other systems. The more identities we create, the more data we spread around, and the greater the damage if a single account is compromised.

The constant pressure to create new accounts and manage passwords also leads to “security fatigue.” People give up, choose convenience over security, and reuse passwords or store them insecurely.

So how long is this situation sustainable? We can keep asking everyone to keep their passwords unique, strong and up to date, but the more accounts we create, the less realistic that becomes. That applies to colleagues who know the risks, and even more so to end users who have little affinity with security.

Problem 2: Password alternatives don’t solve the problem

The problems with passwords are not new, so countless alternatives have been devised by now: think of SSO, passkeys, biometric login, magic links, YubiKeys and all kinds of MFA variants. Each of these solutions is designed to work around the human weakness in password use. But they have one thing in common: they are far from working everywhere.

The result is a fragmented landscape in which users have to know which method belongs with which application. While these solutions are supposed to make logging in safer, for the user it mainly becomes more complex, and therefore less secure. For IT professionals that may still be manageable, but for the average employee it is mostly confusing and error-prone.

Because no alternative works universally the way passwords do, there is constant room for yet another new solution. But adoption is slow: the digital world consists of millions of applications, websites and devices, all with different requirements and capabilities. As a result, every new method ends up being just one more option alongside all the existing variants, without a true standard emerging.

Take passkeys, for example: right now, the MindYourPass database contains 275,000 websites in the Netherlands. That means you can log in to them with passwords. As of January 2026, passkeys.com lists 174 websites that support passkeys: worldwide. That is probably an underestimate, and the real list is likely longer, but even with a factor of 10 we are still talking about a fraction of all websites.

In short, if we want to get rid of passwords entirely, it takes just as much effort as it would take to get every home in the Netherlands off natural gas.

Problem 3: Websites don’t support password managers well everywhere

There is a problem on the website side as well: there is no clear standard for how login pages are technically built. Every form looks different: think of different field names, deviating HTML structures, extra scripts or unclear sequences.

That not only makes it confusing for users to recognize where and how to log in, but above all it complicates the work of password managers: as a result, they cannot always reliably determine where the username and password should be filled in automatically, and they make mistakes or fail to work. And a password manager is exactly what is essential to make logging in both easy and secure. In desktop applications, password managers don’t work at all.

In addition, the rules for passwords differ per website. One site requires special characters, another prohibits them. Some platforms don’t allow repeated characters, even though there is nothing cryptographically wrong with that and password generators do it by default. The result: automatically generated, strong passwords are far from always accepted. This considerably complicates the seamless use of a password manager and forces people to improvise on their own after all, with vulnerable passwords as a result.

As long as this standardization of login pages is lacking, it is impossible for password managers to work correctly. This is frustrating for users, who are forced to deviate from secure patterns as a result. That undermines precisely the purpose of the password manager, which is meant to prevent human error, and it puts the responsibility back on the user, where it doesn’t belong.

The conclusion: Passwords themselves are not the problem

Is it actually a problem that we still work with passwords? In itself, no. The technology is simple and robust, and it works everywhere. If they are unique, complex and long, passwords are secure enough for most uses. Therein lies the challenge, because people are bad at coming up with and remembering such passwords.

The problem therefore lies not in the concept of the password, but in the scale on which we have to apply it, and in the fact that we, as humans, have to think about it. The many password alternatives have produced a fragmented digital landscape that makes working securely needlessly complex. That is not a sustainable situation, and as a cybersecurity field we need to be honest about it.

The painful conclusion is that many of the risks are sustained by the way we have set up the system. We have known for years that passwords are vulnerable. We know that users struggle with digital hygiene. And we know that training, awareness campaigns and new technologies barely produce structural behavior change. Yet we keep assuming that people will adapt to the technology, while the technology takes too little account of how people actually work.

The solution: Back to the basics, with the help of technology

Reality forces us to change course. Not by devising even more alternatives to passwords, but by accepting that passwords will remain for the time being and fundamentally improving how they are used. The only truly feasible solution is a system in which people no longer have to think about their passwords themselves.

The future of secure login lies not in yet another new solution, but in simplifying what already exists.

That is why technology has to take over the work, because passwords are not work for humans. A password manager can do this much better, but it has to work flawlessly. That is why login pages need to be more standardized, so that password managers don’t choke on them.

When password managers work effortlessly, logging in becomes secure and easy: not because people act perfectly, but because the technology does its job. The future of secure login therefore lies not in yet another new solution, but in simplifying what already exists. That means: technology that automatically generates and manages strong passwords, and a digital infrastructure that supports this reliably everywhere.