For decades, IT departments forced everyone to change their passwords every 30, 60 or 90 days. It felt responsible — but security experts now say that routine, scheduled rotation often makes things worse, not better. Our GetMyPassword team explains where the password-rotation rule came from, why guidance has changed, and what to do instead.
Where the rule came from
The idea was simple: if a password leaked, regularly changing it would limit how long a thief could use it. In an era of shared, hard-to-track systems, scheduled rotation seemed like a sensible safety net, so “change your password every 90 days” became the default policy almost everywhere.
Why experts changed their minds
Researchers found that forced rotation backfires. When made to change passwords constantly, people create weaker, predictable ones — Spring2024 becomes Summer2024 — and write them on sticky notes. Modern guidance, including from NIST, now recommends against routine expiration, because the human shortcuts it causes outweigh the benefit.
When you actually should change a password
- After a breach or leak involving that site or your account.
- If you ever reused the password somewhere that was breached.
- When you shared it, or suspect someone else knows it.
- If it is weak or you see signs of unauthorized access.
Change a password when there is a reason to, not because the calendar says so. A strong, unique password kept for years beats a weak one rotated every month.
What to do instead
Focus on quality over frequency. Give each account a long, unique password from our password generator, store them in a password manager, and turn on two-factor authentication. Then change a password only when there is a real reason. This protects you far better than a rotation schedule ever did — with much less hassle.
Frequently asked questions
Should I change my passwords regularly?
Not on a fixed schedule. Modern guidance recommends changing a password when there is a reason — a breach, reuse, sharing or suspected access — rather than every few months, since forced rotation tends to produce weaker passwords.
Why is routine password rotation discouraged now?
Because it pushes people to pick predictable variations and write passwords down. Studies showed the weaker habits it creates outweigh the benefit, so standards bodies like NIST now advise against forced periodic expiration.
What is better than rotating passwords?
Use a long, unique password for every account, store them in a password manager, and enable two-factor authentication. Then change a password only when there is a real reason to, such as a breach.