Passwords have been declared obsolete for years while remaining the default way people prove who they are. The persistence has a practical explanation.
A password has no hardware requirement
Anything a user knows can be typed on any device, in any country, on borrowed equipment, after losing everything they own.
Alternatives generally bind identity to something physical: a phone, a security key, a fingerprint reader. That binding is what makes them stronger and also what makes them fragile.
Every system that depends on a device needs a recovery path for when the device is gone, and recovery paths are often secured by something knowledge-based.
The recovery path becomes the weakest link
If losing a phone means losing an account permanently, support volumes and abandonment rise to unacceptable levels, so providers build a way back in.
That route usually runs through email, a phone number or answers to personal questions, all of which are weaker than the credential they can override.
An attacker attacks the recovery route rather than the strong one, which means the effective security of the system is set by its fallback.
Interoperability took a long time to arrive
Passwords work identically everywhere because they require nothing but a text field, and any website can implement them in an afternoon.
Stronger schemes need agreement between operating systems, browsers, hardware makers and the sites themselves, and each participant has to implement before the scheme is useful.
Standards for device-bound credentials now exist and are supported widely, but the tail of sites that have not adopted them is very long.
Organisations underestimate the migration
Replacing authentication touches account creation, login, password reset, customer support scripts, fraud rules and every automated system that logs in without a human present.
Legacy integrations are the hardest part. Older systems often expect a stored secret and cannot be adapted without being rewritten.
The result is that new credentials are added alongside passwords rather than replacing them, and the password stays as the compatibility layer underneath.
The failure mode is familiar rather than absent
Password reuse and phishing remain the dominant causes of account compromise, and both are well understood by the organisations affected.
Managers, prompts and breach checks reduce the damage without changing the model, which makes incremental improvement cheaper than replacement.
So the password persists not because it works well but because everything replacing it must also answer what happens when the replacement is lost.