The key that is also a password
The employee tapped a card against the reader beside a glass door in an office building in midtown Manhattan, heard the click, walked through. At her desk, she slid the same card into a slot on her workstation. The screen unlocked, the VPN connected, the cloud applications loaded. No password typed, no second device checked. The card had just played the role of both key and password. As of March 18, 2026, those are, for the first time at scale, the same thing.
HID Global announced it at ISC West 2026 in Las Vegas — the trade show where security professionals come to examine cameras, turnstiles, and reader hardware, not to have their assumptions about identity reorganized. The company, whose RFID proximity cards have hung from every corporate lanyard since the 1990s, unveiled Converged Credentials: a single standards-based credential that merged what had been two entirely separate worlds.
HID had spent three decades building both sides of that divide. Their Seos credentials lived in the plastic cards that opened office doors. Their smart card products handled PKI-based workstation authentication. For the entire history of corporate security, those two systems had been managed by different departments — physical security on one side, IT on the other — running different software, issuing different cards, speaking different protocols. The Converged Credential was designed to collapse that wall, which made it, in the quiet bureaucratic way of enterprise security, something genuinely new.
The credential could live in a Crescendo smart card or a portable FIDO2 key — a USB dongle small enough to hang on a keyring. When pressed to a door reader, it authenticated against a FIDO2 public-key pair stored on the chip; the door opened. When plugged into a workstation or tapped to a desk reader, the same chip authenticated to Windows, to cloud applications, to the VPN — without a password ever being stored or transmitted anywhere. FIDO2, ratified as a web standard in 2019 by the FIDO Alliance and the W3C, relies on a public-private key pair: the private key never leaves the device, so there is nothing for an attacker to extract from a server.
Six days after ISC West, Swissbit demonstrated at RSA Conference 2026 in San Francisco that its iShield Key 2 — a hardware FIDO2 key already supporting 300 stored passkeys — now also carried HID Seos, the same physical-access credential that opens turnstiles in a quarter of the world’s large offices. Two shows, two companies, one week, the same message: the door lock and the computer login had arrived at the same address.
What was new in March 2026 was not each technology in isolation — mobile credentials, FIDO2 passkeys, and smart card PKI had all existed for years, sitting in adjacent silos. What was new was the unified lifecycle. One issuance event, one revocation event. When an employee left, a single administrative action terminated their access everywhere, not two separate calls to two separate departments that had never needed to coordinate before. That integration, as HID’s 2026 State of Security and Identity Report noted, was what 75 percent of organizations had been trying to achieve.
For six thousand years, the key was a physical thing carried in a pocket. For fifty years, the password was a mental thing carried nowhere. What arrived in an office building in March 2026 was a device that could play either role — which is to say, the two things had finally, formally, become one.
Sources
- HID Showcases Identity and Access Innovations at ISC West 2026 — HID Global newsroom — March 18, 2026 announcement; Converged Credentials product details (Crescendo smart card, portable FIDO2 key, NFC microreader); market statistics from HID State of Security and Identity Report.
- Inside the Push to Converge Physical and Digital Access — Security Info Watch — Ramesh Songukrishnasamy CTO context; 75% convergence adoption figures; barriers to convergence (52% managing multiple identity systems, 37% implementation complexity).
- Swissbit Adds HID Seos to iShield Key 2 at RSAC 2026 — Security Boulevard — March 24, 2026 RSAC announcement; iShield Key 2 technical specs (300 passkeys, USB-A/USB-C); Alexander Summerer quote on “unifying physical and digital access in one device.”