"forced password changes make you safer"

securityIT support

Mandatory 90-day rotations trained people into Password1, Password2 - predictable mutations attackers model. Current guidance: long unique passphrases, changed on evidence of compromise.

NIST SP 800-63B recommends against periodic forced changes and against composition rules; length and uniqueness (via a manager) beat ritual complexity.

Mandatory password expiry every ninety days was standard advice for decades, and the guidance was reversed by the organizations that originally issued it. NIST and the UK's NCSC both now recommend against routine forced rotation, and the reasoning is behavioural rather than cryptographic.

Forced frequent change produces predictable passwords. People increment a number, change one character, or cycle through a small set, because they have to remember the result under time pressure, and the resulting passwords are weaker and more guessable than what the same person would choose once. It also increases reset requests, which trains help desks to reset credentials on request, which is a social engineering opening.

The replacement guidance is more effective and less irritating: long passphrases, checked against known-breached lists at the point of setting, with multi-factor authentication, and change forced only on evidence of compromise. The reason the old rule persists anyway is that it is easy to audit and easy to demonstrate to a regulator, which is a good illustration of how a compliance framework can outlive the evidence that produced it.

Disputed / commonly mistold A popular version of this story is inaccurate - see the note above.

← All glossary entries