# What a password is, and why we've had it wrong for sixty years

> The computer password was born in 1961 and the first breach came a year later. Almost everything we were taught about passwords came from a 2003 guess its own author regrets.

2026-07-17 · David Carrero · password.es
Original: https://password.es/en/blog/what-is-a-password/

---

A password is the answer to a very old question: **are you one of us?**

Computing didn't invent it. Polybius, writing in the second century BC, describes
how the Roman army circulated a word each night on a wooden tablet — the
*tessera* — passed from unit to unit and back to the command. If you knew it, you
were one of them. If you didn't, you weren't.

Two thousand years later we are doing exactly the same thing. The only things
that have changed are who's asking, and how fast they can try to guess the
answer.

## 1961: the password enters the computer

In November 1961, MIT demonstrated **CTSS** (*Compatible Time-Sharing System*),
led by **Fernando Corbató**. It was a new idea: one very expensive computer,
shared by several people at once.

And that's where the problem showed up. If the machine belongs to everyone, each
person's files have to belong to that person. The computer needed a way to know
who was typing. The solution was the most obvious one available, and the most
Roman: give every user a word of their own.

It's worth being precise: Corbató did not invent the password. He invented the
**per-user password on a multi-user computer**, which is a different thing. Late
in life, he said the whole thing had become "a nightmare".

## 1962: the first breach, and it was over machine time

A year later **Allan Scherr**, a PhD student at that same MIT, had a very mundane
problem: he was allotted four hours of computer time a week and needed more for
his thesis.

So he asked the system to **print the password file**. That's it. It was sitting
there in plain text, and nobody had considered that someone might ask. With the
printout in hand, he used other people's accounts to keep working.

The trick isn't the interesting part. The motive is: **the first password breach
in history wasn't committed by a criminal, but by someone who wanted to keep
working**. Sixty years on, most security holes still start with reasonable people
looking for the short way round.

## 1979: someone realises you shouldn't store them at all

For almost two decades, many systems stored passwords as they were. If someone
read the file, they had everything.

In 1979, **Robert Morris and Ken Thompson** published a paper in *Communications
of the ACM* called "Password Security: A Case History", about what they had done
in Unix. Two ideas that underpin everything today:

- **Don't store the password, store its hash.** The system doesn't need to know
  what your password is; it only needs to check whether what you just typed
  produces the same result.
- **The salt**: add a random value to each password before hashing it, so that
  two people with the same password don't share a hash, and so nobody can
  precompute a table and break them all at once.

When we say today that a service "shouldn't know your password", we are quoting a
paper from 1979.

## 2003: the rules we all learned, and where they came from

In 2003, **Bill Burr**, at the American NIST, wrote the document that would come
to govern how half the world asked for passwords: **SP 800-63**. Everything you
recognise instantly came out of it:

> At least one uppercase letter, one number and one symbol. Change it every 90
> days.

It sounded like science. It wasn't. Burr had no good data on real passwords —
there was hardly any — so he leaned on what existed and reasoned his way to what
seemed sensible: more character variety, more combinations, more security.

The trouble is that **people are not random generators**. Ask someone for an
uppercase letter and they'll put it first. Ask for a number and it goes at the
end. Ask for a symbol and it's a `!`. And if you force a change every three
months, `Summer2024!` becomes `Autumn2024!`.

The result was an entire generation of passwords that **look complex and are
trivial**, and exhausted users who reuse them everywhere because they've had
enough.

## 2017: NIST retracts, and so does Burr

In 2017 NIST published **SP 800-63B** and reversed almost all of it:

- **Length matters more than complexity.**
- **No forced rotation** unless there's evidence of compromise.
- **Check the password against breach lists** instead of demanding symbols.

That same year, Burr told the *Wall Street Journal* he regretted much of what he
had written. It is one of the most honest retractions computer security has
produced — and there are still thousands of forms demanding a symbol because of a
document its own author disowned.

## Why this isn't ancient history

All of this has a very concrete consequence, and you can see it right here.

Our own [checker](/en/checker/) ran on 2003 logic until very recently: it counted
uppercase letters, numbers and symbols. It gave **92% "Very strong"** to
`Contraseña1!` — literally the Spanish word for "password" — and **0% "Very
weak"** to a five-word random phrase, which is incomparably better.

It was rewarding exactly the wrong thing. We've changed it: it now looks your
password up in dictionaries of words, names, cities and keyboard patterns, and
tells you how long it would really take to fall.

And that's why the [generator](/en/) shows you **bits of entropy** instead of a
percentage. A percentage means nothing. Bits do: they are how many times someone
who knows nothing about you would have to try.

## What to do, in two lines

- **Long beats twisted.** Four or five random words beat `P@ssw0rd` by many
  orders of magnitude.
- **Different everywhere, kept in a manager.** It's the one rule from 2003 still
  standing, and the one we ignored most.

The question is the same as it was in second-century Rome: *are you one of us?*
What's changed is that whoever asks can now try a billion answers per second.
Yours had better not be in the dictionary.

---

*Sources: F. J. Corbató and CTSS (MIT, 1961) · Allan Scherr's own account of 1962
· R. Morris and K. Thompson, "Password Security: A Case History", Communications
of the ACM, 1979 · NIST SP 800-63 (2003) and SP 800-63B (2017) · Bill Burr's
remarks to the Wall Street Journal, August 2017.*