How often should you change your passwords? Less than you were told

For decades, workplaces forced everyone to change passwords every 60 or 90 days, and most people assumed that was just good hygiene. Security researchers have since reversed that advice. Routine scheduled changes don’t help, and in practice they made things worse. Here’s what happened and what to do instead.

Why forced rotation backfired

When people are made to change a password constantly, they don’t invent a fresh strong one each time. They make the smallest possible tweak: Password1 becomes Password2, then Password3. They write the current one on a sticky note. They reuse a familiar base everywhere so they can keep track. Attackers know this pattern and exploit it. The churn produced weaker, more predictable passwords, so the guidance shifted. The U.S. standards body NIST, in its digital identity guidelines, moved away from mandatory periodic expiration and from forced complexity rules, toward long passwords checked against known breach lists. Confirm the exact current wording if you’re writing policy, but the direction has held firm for years.

Change on evidence, not on a calendar

The right trigger to change a password is a signal, not a date. Change it right away if a site tells you it was breached, if a breach checker finds it in a dump, if you shared it with someone, or if you see a login you don’t recognize. When that happens, change it everywhere you reused it, which is the real reason a single leak can cascade.

The setup that makes rotation pointless

Here’s the freeing part. If every account already has its own random password stored in a manager, plus two-factor on the important ones, a single leak is contained by design. You change the one password that leaked and you’re done, no mass reset weekend required. Do the work once to get unique random passwords in place, and ‘how often should I change them’ stops being a question you need to schedule.