Why we no longer make you change your password every 90 days

What went wrong

Forced password changes were meant to limit the damage if a password was stolen. In practice, people who had to invent a new password every few months did what anyone would:

• Small changes: Summer2025! became Fall2025!, then Winter2025!
• Writing them down on notes stuck to screens.
• Reusing the same pattern across work and personal accounts.

Attackers know these patterns. If they have an old password, the next one is easy to guess. The rule made passwords weaker and people more frustrated, and it did little against a stolen password, which attackers use within hours.

Government security agencies, including the UK’s National Cyber Security Centre, now advise against regular forced changes.

What works better

• A long password or passphrase, such as three or four unrelated words, that you do not use anywhere else.
• Multi-factor authentication, so a stolen password alone does not get anyone in.
• A password manager, so every account can have its own strong password without anyone remembering them.
• Changing a password when there is a reason: it appeared in a leak, you typed it into a suspicious page, or someone else may know it.

When you will still be asked

If your IT team asks you to change a password, there is a reason. Do it promptly, and choose something completely new.