Your password must contain joy
Please choose a password containing at least one uppercase letter, one lowercase letter, one number, one special character, one endangered bird species, two childhood ambitions and the smell of regret
We’ve all been here. Squinting at the rules. Adding an exclamation mark. Realising you’ve now typed a password so secure even you can’t remember it. So you click "reset." Again.
It’s become a kind of game. Except no one’s winning, and the prize is logging into your water bill.
Naturally, someone decided we needed something better. So now, we have… passkeys.
What are they? Excellent question. No idea.
They just showed up one day and I went with it. They worked, so I smiled politely and kept walking - like a bouncer vaguely recognised my face and waved me through. Just go with it. It worked.
Apparently they’re tied to your device. Or your fingerprint. Or maybe your soul. I’m now slowly beginning to worry about what was in the Terms & Conditions that I casually approved that time1. But they feel safer, which I guess is an important thing.
Then there’s biometrics - fingerprints, face scans, retinal patterns. All very sleek. Until you remember that you only get one of each, and if someone steals it… well, you can’t exactly grow a new thumb. Maybe I’ve been watching too many mid-90s science fiction movies, but I still have a fear that one day Wesley Snipes will rock up and attempt to skewer my eyeball on the end of a pencil, in order to steal the £37.502 in my bank account.
Sometimes my face doesn’t match because I’ve put on glasses, got up the wrong way, or simply lost the will to live. Other times, I gently press my finger to the sensor, only to be told it’s not me - like my own phone is gaslighting me.
And just when I think I’ve outsmarted the system by choosing a decent password and remembering it, I type it in… and I’m told I can’t reuse an old password.
So I did remember it. And now I’m being punished for it.
We don’t talk enough about the emotional damage of that moment.
We’ve designed these systems like digital obstacle courses. CAPTCHAs ask us to identify motorcycles or traffic lights, except they’re as low-res as humanly possible and screenshotted from a 1980s b-movie. "Select all squares that contain a chimney." Is that a chimney or a blurry thumb? Define "chimney" please, because that sticky-uppy-bit could easily be something else. Why am I doubting my own reality?
I’ve clicked things that weren’t bicycles just to get on with my day. I’ve failed humanity’s Turing test more times than I can count.
Then of course there’s the two-factor authentication code that arrives on your other device while you’re already mid-login panic. You grab your phone. Open the message. Read the code. Return to the screen. It’s expired.
Try again.
Now the app has logged you out.
Start over.
And for what? To check your inbox? To access a site you visit weekly? To view a gas bill from 2021 that somehow still requires military-grade encryption?
I get it. I do. Security is important. But the way we do it feels less like trust and more like suspicion. Every login is an interrogation. Every reset is a punishment for not remembering the elaborate riddle you invented six months ago while stressed and slightly drunk.
What’s strange is how we’ve all just accepted it. We click "I forgot my password" like we’re at confession. We nod when asked to verify ourselves three times, as if we’re applying for citizenship, not checking a calendar invite.
And don’t even get me started on the number of times I’ve ticked "remember me on this device." I’m looking at you, Microsoft.
It’s not that I want less security. I just want less hostility. I want the systems I use every day to recognise me without suspicion. To greet me like a regular, not a stranger with bad intentions and a suspect browser history.
Maybe that’s why passkeys are quietly brilliant, even if we don’t quite understand them yet. They say: "We know it’s you. Come on in". There’s something comforting in that.
Because the truth is, most people aren’t trying to break into anyone else’s account. We’re just trying to get through the day. To pay the bill. Read the email. Upload the form. Live our digital lives without being asked to prove - once again - that we can recognise a traffic light.
So no, my password doesn’t need to contain joy. But the experience of using it probably should.
Every time
Optimistic estimation