There are a couple of things here: I think the most important is that without rate-limiting, there are no such things as pass<i>words</i>. There can only be pass<i>phrases</i>. That is, if &quot;something you know&quot; is a shared secret, it need to be high entropy, effectively around 128 bits. That&#x27;s much harder than most people think.<p>You could probably make a list of 256 common, short words that are distinguished by their first two letters[1], but to encode 128 bits of entropy, you&#x27;d need <i>19</i> words, (or 16 if you managed to get use 512 words). Even if you picked only the first two letters, that&#x27;s best case 32 characters. It&#x27;s a lot to type blind, it&#x27;s a lot to remember, it&#x27;s complicated to cycle the phrase.<p>So it&#x27;s better to not have to remember the password - use a password manager. Or, if you could somehow avoid the possibility of off-line attack, and guarantee solid rate-limiting -- much less entropy might be needed. A 4-digit pin is probably on the low side (consider that on a site with ~100.000 users, if you tried any set of three pins, you&#x27;d probably compromise many accounts, assuming uniform distribution of pins).<p>Another way, is to continue using a shared secret, but prove knowledge in a different way: eg using TOTP[2]. On the other hand, TOTP shares some of the disadvantages of <i>unsalted</i> passwords: the secrets are stored in plain text both on your one-time token generator (your insecure smartphone), <i>and</i> on the server. On the other hand, they&#x27;re harder for most users to re-use than passwords are (users typically don&#x27;t know the secret used to generate one-time passwords).<p>But all these have another problem: how to you protect your secrets? You could use full disk encryption... protected by ... a password?<p>Still, the idea of using a fingerprint for authentication, especially on a device <i>filled with your fingerprints</i> seems like a pretty bad idea. Never mind the fact that once compromised they can never be changed.<p>As for your last point, I do think the combination of something like a yubikey neo[3] along with NFC is probably the sweetspot for practical security right now. You can use it to unlock your smartphone, and your computer.<p>[1] (26^2=512, but not all combinations are common, fitting 256 should probably be possible, even if the more common combination of vowel+consonant is only ~6*20=120. Possibly in combinations with the numbers 1..99)<p>[2] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Time-based_One-time_Password_Algorithm" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Time-based_One-time_Password_A...</a><p>[3] <a href="https:&#x2F;&#x2F;www.yubico.com&#x2F;products&#x2F;yubikey-hardware&#x2F;yubikey-neo&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.yubico.com&#x2F;products&#x2F;yubikey-hardware&#x2F;yubikey-neo...</a>