The Old Rule and Why It Backfired
The 90-day password rotation rule originated decades ago when password cracking was slower and data breach notification was nonexistent. The theory was that forcing regular changes would limit the window of exposure if a password was compromised. In practice, it created a different problem: password fatigue.
When people are forced to change passwords frequently, they don't create genuinely new passwords — they create predictable variations. "Summer2024!" becomes "Fall2024!" becomes "Winter2025!" Researchers at Carnegie Mellon University documented this pattern extensively: when users were required to change passwords, they shifted existing passwords by incrementing numbers, changing seasons, or adding a single character to the end. These patterns are well-known to attackers and are specifically built into cracking rulesets.
NIST Special Publication 800-63B (updated 2024) explicitly states: "Verifiers SHOULD NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator." This is official U.S. government security guidance. The EU's ENISA (European Union Agency for Cybersecurity) has issued similar updated guidance.
When You Must Change Your Password
While routine rotation is no longer recommended, certain specific situations require an immediate password change. These are genuine security events, not arbitrary calendar milestones:
⚠️ A service you use reports a data breach
Change the password for that service immediately, and check every other site where you used the same password. Use haveibeenpwned.com to check if your email appears in breach databases. Credential stuffing attacks against reused passwords begin within hours of a breach being posted.
⚠️ You receive a 2FA code you didn't request
An unsolicited 2FA code means someone has your password and is attempting to log in. The 2FA stopped them this time, but your password is compromised. Change it immediately and review account activity for unauthorized access.
⚠️ Unexpected login alerts or suspicious account activity
If you receive login notifications from unexpected locations or devices, or notice account settings changed without your action, your credentials may be compromised.
⚠️ You logged in on an untrusted or public computer
Public computers at libraries, hotels, and print shops may have keyloggers installed. If you entered your password on one, change it promptly. This applies even to trusted friends' computers if they have malware.
⚠️ You shared a password that no longer needs to be shared
If you shared an account with a roommate who moved out, an employee who left, or anyone who should no longer have access — change it immediately. Trust but verify applies; end-of-relationship access revocation is critical.
⚠️ Your current password is weak, short, or reused
A weak password or one reused from another site should be changed to a unique, randomly generated replacement regardless of age. 'No reason to change' assumes the existing password is strong in the first place.
The Password Rotation Schedule That Actually Works
Modern security guidance has shifted from calendar-based rotation to risk-based rotation. Here's a practical framework:
| Account Category | Change When | Minimum Standard |
|---|---|---|
| Primary email | Any breach alert; suspicious activity | Unique 16+ char random password + 2FA |
| Banking & financial | Breach, suspicious transactions | Unique 16+ char random password + 2FA |
| Password manager | If master password ever used elsewhere | Passphrase + 2FA; memorized, not stored |
| Work/corporate accounts | Per company policy; on role change | Follow organizational IT policy |
| Social media | Breach notifications | Unique 14+ char password + 2FA |
| Shopping & low-risk | Breach notification only | Unique password stored in manager |
How to Change a Password Correctly
When you do need to change a password, doing it correctly matters. Common mistakes include changing to a variation of the old password, not changing it on all devices, or not logging out existing sessions.
- Generate a completely new, random password using a password generator. Don't modify your old password or use any recognizable pattern.
- Use your password manager's password generation tool, or generate one here and immediately save it to your manager before navigating away.
- After changing, log out of all active sessions on the service. Most platforms have a "Sign out all devices" or "Revoke all sessions" option in security settings. This invalidates any sessions an attacker may have established.
- Update saved passwords in your password manager before forgetting the new credential.
- Enable 2FA if you haven't already, as the immediate next step after a password change resulting from a suspected compromise.
What Actually Protects You Better Than Rotation
If periodic password changes don't provide meaningful security, what does? The research is clear on which practices have the highest impact:
✓ Unique passwords for every account
Eliminates credential stuffing — the most common account takeover method. A breach of one site cannot compromise any other site.
✓ Password length over complexity
NIST research confirms length is the primary determinant of crack resistance. A 20-character random password vastly outperforms a 10-character 'complex' one.
✓ Two-factor authentication
Stops 99%+ of automated account takeover attempts even when the password is known. Microsoft's own data shows 2FA blocks 99.9% of attacks.
✓ Breach monitoring
Knowing immediately when your credentials appear in a breach lets you respond before attackers exploit them. Services like HaveIBeenPwned offer free email alerts.
✓ Password manager for all accounts
Makes unique passwords for 100+ accounts practical. Eliminates the temptation to reuse passwords because you don't need to remember them.
Special Cases: Enterprise and Compliance
If your employer requires periodic password rotation, follow their policy — organizational IT departments may have specific compliance, regulatory, or audit requirements. However, the trend among enterprise security teams is moving away from mandatory rotation, following NIST, CISA, and NCSC (UK National Cyber Security Centre) guidance.
If you're in a role where you set password policy, review NIST SP 800-63B's recommendation to remove periodic rotation requirements from organizational policy. Replace them with breach-triggered rotation, anomalous access detection, and mandatory password manager use. This approach consistently produces better security outcomes than calendar-based rotation.
The Bottom Line
Don't change passwords on a calendar schedule. Do change them when there's an actual security event or a genuine risk factor. Invest the time you would have spent on routine rotation into meaningful improvements: switching to unique passwords for every account, enabling 2FA, setting up a password manager, and signing up for breach alerts.
A strong, unique password that never changes is significantly more secure than a weak password changed monthly. The goal is password quality and uniqueness — not rotation frequency.