In the age of Face ID and fingerprint scans, are passwords a relic from a bygone digital era, or the last line of defence we’ll always need? 

It’s 9 a.m. on a Monday. You tap your phone to start your commute, earbuds in, mind on the day ahead. Later, at your local coffee shop, you greet the barista, then lift your phone to unlock with Face ID. A quick glance at the screen, a tap in your digital wallet, and seconds later your cappuccino is in hand. Your wallet never left your pocket, your password never left your memory, and you realise the ritual of authentication has become almost invisible, blending seamlessly into the rhythm of your morning.

From unlocking your phone with a glance to paying with a fingerprint, biometrics are fast becoming the keys to our digital lives. 

Why Are Passwords Still a Thing?

(Image: Unsplash)

For most, biometric authentication feels like the obvious next step in the evolution of digital security. It’s immediate, seamless, and comes with zero cognitive load attached. Passwords, by comparison, are friction embodied. They demand to be remembered, typed, reset, forgotten, and then remembered again. But there is a reason why passwords haven’t disappeared overnight and isn’t nostalgia.

The truth lies in risk management. Even the most sophisticated systems can falter under the wrong conditions. A sudden downpour can confuse a Face ID scan. A small cut can render a fingerprint unreadable. Devices get lost, stolen, or reset. Every exception is a potential point of failure and a moment where convenience collides with security. 

The Argument of Edge Cases

The Office for National Statistics (ONS) highlights that older adults in the UK face disproportionate digital exclusion. In 2018, 5.3 million adults (around 10% of the population) had never used the internet, with age emerging as a key factor in who remains offline. (Image: Pexels)

For some users, the barriers run deeper. Users with disabilities may struggle with stillness or positioning during enrolment. Motor impairments can make it hard to hold a phone steady, and cognitive impairments can make fallback PINs or passcodes harder to manage. Even temporary changes such as aging, injuries, or simply wearing a mask can shift the reliability of a biometric scan.

Then there are the questions of trust and privacy. Unlike passwords, you can’t “reset” a fingerprint or change your face. If biometric data is ever compromised, the consequences are permanent. That makes secure storage, transparency, and user consent non-negotiables in passwordless design.

In their blog “Designing a Passwordless Future That Won’t Leave Users Behind”, Amel Bourdoucen, a User and Impact Researcher at F-Secure, highlights the often-overlooked edge cases that hinder the widespread adoption of passwordless authentication, particularly for users with disabilities, chronic illnesses, or those dependent on caregivers. Their insights offer UX designers a clearer path toward building more inclusive digital experiences.

The Argument of Security

(Image: Unsplash)

Biometrics verification promises convenience, speed and security, but they are far from infallible. The very traits that make Face ID, fingerprint scans and voice ID appealing also make them targets to cyber threat actors.

Presentation attacks are one such example. These attacks occur when a threat actor uses fake or fraudulently obtained data to impersonate an authorised user to gain access to a device, account or a system. Depending on the method of verification, they may employ fingerprint, facial or voice spoofing to gain unauthorised access. 

With the advent of generative AI, deepfakes add a new layer of risk. In a September 2025 study, researchers behind “Unmasking Digital Deceptions: An Integrative Review of Deepfake Detection, Multimedia Forensics, and Cybersecurity Challenges” highlight how advances in AI, particularly GANs, enable realistic synthesis of faces, videos, and voices. These deepfakes can bypass authentication, compromise sensitive accounts, and propagate identity theft. 

The Takeaway 

Passwordless authentication has become tempting: fast, seamless, and seemingly invisible. But convenience alone doesn’t make it foolproof. Biometrics can fail, be spoofed, or exploited, and emergent technologies add new threats to identity and trust. Passwords, for all their friction, remain a crucial fallback, bridging the gap between usability and security.

The challenge upon designers is to anticipate edge cases, embrace inclusivity, and build transparent, resilient flows that protect users without adding cognitive load. 

While passwordless authentication could shape the future of digital security, it requires robust risk management, user trust, and practical reliability to balance convenience with protection to fulfil the vision of a seamless digital experience. The question to ask, however, is whether we are sufficiently prepared in our current security practices to achieve this evolution.