Microsoft just officially retired the Custom Primary Password feature inside the Edge browser. Starting today, you can no longer use a dedicated master password to lock your built-in web credentials. The browser now forces you to authenticate using your device-based security. That means your face, your fingerprint, or your standard Windows Hello PIN is the only way to view or autofill your saved login details.
This update arrives as part of Microsoft’s aggressive global strategy to eliminate password-based authentication entirely. The company began systematically killing off passwords last year, starting with the Authenticator app, and recently ended SMS code support for standard account sign-ins to force users toward passkeys.
If you previously opted into the Custom Primary Password feature, Edge is automatically migrating your browser to the “Prompt for the device sign-in options” method right now. Microsoft argues that Windows Hello provides superior resilience against phishing attacks compared to a typed master string. The industry data actually backs up this transition. According to NordPass research data tracking Microsoft’s broader password phase-out, the average number of passwords an individual manages dropped from 168 in 2024 to just 120 in 2026.
The change also reaches deep into corporate IT environments. Microsoft marked the PrimaryPasswordSetting group policy as completely obsolete in Edge version 149. Network administrators can no longer configure a distinct browser-level password, as the system now enforces OS-level authentication across all deployments.
Why Traditional Vault Users Face a Hard Switch to 1Password
Taking away the browser-level master password alters how users secure their digital lives on shared computers. For years, the dedicated vault password allowed someone to hand their unlocked laptop to a family member or coworker without instantly granting access to their bank logins and email accounts. Now, anyone who knows your basic Windows PIN can automatically autofill your Edge passwords.
Because of this architectural change, users who still require that secondary layer of vault security are moving away from browser-based managers entirely. They are now switching to third-party password managers like 1Password or Bitwarden, which continue to support the traditional master-password lock model independently of the operating system.