Security Passwords: how to make them strong and keep track of them
How often should you change your password?
What NIST, the UK NCSC, Canada, Microsoft and PCI DSS say about scheduled password changes, why 90 days persists, and the triggers that mean change it now.
The short answer
- Do not change a password on a schedule: change it when there is evidence it has been exposed, and otherwise keep a long, unique password.
- NIST's 2025 guidance says services shall not require periodic password changes, and shall force a change when there is evidence of compromise.
- Forced changes produce predictable edits: in research the FTC summarized, for 17% of accounts the new password could be guessed from the old one in under five tries.
- The 90 day rule survives mainly in the PCI DSS card payment standard, and only where a password is the sole sign-in factor.
- The real triggers are a breach notice, a leak warning, a phishing page, an unknown sign-in, a shared password or malware on your device.
You should not change a password on a schedule. Change it straight away when there is a reason to think it has been exposed, and otherwise leave a long, unique password alone. That is the written position of the US standards body NIST, the UK's National Cyber Security Centre, the Government of Canada and Microsoft. The "every 90 days" rule that still circulates, and the "every three to six months" you will find on many advice pages, are not what any of them recommend for your personal accounts. The one place a 90 day clock survives is a narrow payment industry rule for staff who sign in with a password alone.
What the standards bodies actually say
The table gathers the current wording from the bodies that write password policy for governments, banks and large employers. The last column matters as much as the third: none of them says "never change it", they say change it when something happened.
| Source | Document | Scheduled changes | When a change is required |
|---|---|---|---|
| NIST (US) | SP 800-63B, version 4, August 2025 | Services "SHALL NOT require subscribers to change passwords periodically" | Services "SHALL force a change if there is evidence that the authenticator has been compromised" |
| NCSC (UK) | Password policy: updating your approach | "Regular password changing harms rather than improves security" | When you know or suspect it has been compromised |
| Government of Canada | Guideline on Password Security, modified December 2025 | Forced regular changes have "little effect on security" | A known or suspected compromise, or a change in password policy requirements |
| Microsoft | Windows security baseline, 2019, and Microsoft 365 admin guidance | Dropped from the baseline as "an ancient and obsolete mitigation of very low value"; recommended setting for cloud accounts is never expire | Evidence of theft, which Microsoft says you would act on immediately |
| PCI DSS 4.0 (card payments) | Requirements 8.3.9 and 8.3.10.1 | At least every 90 days, only where a password is the sole factor, unless access is analyzed dynamically | Does not apply at all where multi-factor authentication is used |
Two other details from the NIST document explain the direction of travel. A password used on its own must be at least 15 characters, and services must check new passwords against a blocklist of common and breached ones. The weight has moved from how often you change a password to how good it was in the first place, which is covered in why length beats complexity.
Why forced changes made passwords weaker
A scheduled change is meant to lock out someone who has quietly stolen your password. The research that ended the practice tested exactly that. Researchers at the University of North Carolina used a dataset of over 7,700 accounts to measure how hard it was to get from an expired password to the one the user chose to replace it. As the US Federal Trade Commission's chief technologist summarized it in 2016, for 17% of the accounts, knowing the previous password let them guess the next one in fewer than five guesses. An attacker who knew the previous password and had stolen the file of scrambled (hashed) passwords could, in an offline attack, find the current password for 41% of accounts within three seconds per account, on a typical 2009 research computer.
The reason is human. Told to pick a new password every quarter, people make the smallest change the form will accept: Summer2026! becomes Autumn2026!, a trailing 3 becomes a 4, one character moves. Microsoft's baseline note describes the same pattern: when forced to change, people "make a small and predictable alteration to their existing passwords, and/or forget their new passwords." An attacker who holds the old one runs those alterations first. The NCSC adds three further problems. Stolen passwords are generally exploited immediately, long before any 90 day clock runs out. Resetting a password tells you nothing about whether a compromise happened. And an attacker already inside the account will probably see the reset request too.
Microsoft's own arithmetic makes the point. The Windows default maximum password age is 42 days, and its baseline had said 60, and before that 90. If a password has been stolen, 42 days is a ridiculously long time to let a thief keep using it. If it has not been stolen, the change bought nothing and cost a weaker password.
The triggers that mean change it now
Every source above agrees on this half of the answer. These are the situations that count as evidence, and what each one means you should change.
| What happened | What to change | Why |
|---|---|---|
| A service tells you it had a breach | That account, plus every account where you used the same password | Leaked email and password pairs are replayed against other sites |
| A leak checker or your password manager flags a password | Every account using that exact password | The password is now on lists attackers guess from first |
| You typed a password into a page you reached from a link and now doubt it | That account, at once, from a fresh browser tab | Phishing pages pass what you type on in real time |
| A sign-in alert you do not recognize | That account, then check its recovery email and phone | An attacker's first move is often to change the recovery details |
| You told someone the password, or a person who knew it has left your life | The shared account | Anyone who knew it can still use it |
| You signed in on a computer you do not control | That account | A shared machine can record keystrokes or keep the session open |
| Malware was found on your device | Everything typed or saved on it, after cleaning, from another device | Password stealing malware takes saved browser passwords in bulk |
Two rows need a word of explanation. The leak checker row is the most common real trigger, and how a breach check works without seeing your password explains what a match does and does not mean. The phishing row has a time element: if you typed a password into a fake page, change it before doing anything else, then follow the steps after clicking a phishing link.
Why "every 90 days" is still everywhere
If the standards bodies agree, why do so many people still believe in the schedule? Three reasons, and none of them is that the schedule protects a personal account.
The first is that it is real at work for some people. PCI DSS, the security standard for organizations that handle payment cards, still requires a change at least every 90 days where a password is the only thing protecting access, unless the organization analyzes each account's security posture dynamically instead. The same requirement stops applying once multi-factor authentication is in place, which is exactly NIST's point in another form. Windows networks also let an employer set an expiry, and Windows applies a maximum password age by default unless someone turns it off.
The second is audit habit. Microsoft wrote in 2019 that organizations with stronger protections that chose 365 days, or no expiry, "will get dinged in an audit unnecessarily". A rule that auditors check stays in place long after its value is gone.
The third is that the old advice is easy to repeat and sounds responsible. "Change it every three months" is a clear instruction. "Change it when there is evidence of compromise" asks you to know what evidence looks like, which is why the trigger table above is the useful part of this page.
Where the no schedule answer stops
The advice assumes the password is worth keeping. If it is short, built from a name or a year, or used on more than one site, change it now, not because time has passed but because it was never good enough. The habit that does the real damage is reusing one password across accounts, because one site's leak then opens the others, and no schedule fixes that.
Your employer's rules beat this page. If a work system forces a change, comply, and use the prompt as a chance to generate a fresh random password rather than nudging the old one. Shared and family accounts are another exception in practice: when the group changes, the password should too, and sharing a password without putting it in a message makes that easier next time.
Finally, the absence of a trigger is not proof that nothing happened. Breaches are sometimes discovered months later. That residual risk is the one a scheduled change was meant to cover, and the modern answer to it is a second factor, not a calendar: with two-factor authentication turned on, a password stolen without your knowledge is not enough to get in.
What to do instead of a schedule
- Start with your email account. It can reset almost everything else, so make its password long and unique, and follow the settings that lock down an email account.
- Let a password manager generate the rest. A random 20 character password per site removes the temptation to make small variations, and how a password manager protects its vault covers why one place is safer than many.
- Turn on breach alerts. Most managers and browsers warn you when a saved password appears in a leak. That warning is your schedule.
- Add a second factor to email, banking and anything holding a payment card.
- Act on triggers the same day. Use the table above, and change the password from a device you trust.
Common questions
Is it bad to change your password too often?
It can be. Frequent changes push people toward small, predictable edits of the same password, and an attacker who has an old one tries those edits first. In research summarized by the FTC, for 17% of accounts the new password could be guessed from the previous one in fewer than five tries. Changing a weak or reused password to a strong unique one is always good. Changing a strong one for no reason adds nothing.
Does NIST still recommend changing passwords every 90 days?
No. NIST's SP 800-63B, finalized as version 4 in August 2025, says services shall not require people to change passwords periodically. It also says services shall force a change when there is evidence a password has been compromised. The 90 day figure you may have heard comes from older corporate policies and from the payment card standard, not from NIST.
Why does my work make me change my password every 90 days?
Usually because of an old policy or a compliance rule. PCI DSS still asks for a change at least every 90 days where staff sign in with a password alone, and Windows applies a maximum password age by default unless an administrator turns it off. Follow your employer's rules, and treat each forced change as a chance to create a fresh random password rather than adding a number to the old one.
Should I change my passwords after a data breach?
Yes, for the breached account and every other account where you used the same password. A breach is exactly the evidence of compromise that every standards body says should trigger a change. If the service stored passwords in a way that was not cracked, the risk is lower, but you rarely know that for certain, so change it anyway and turn on a second sign-in step.
How often should I change my Wi-Fi password?
On the same logic: when there is a reason, not on a calendar. Change it if someone who should no longer have access knew it, such as a former tenant or roommate, if you find devices on your network that you do not recognize, or if it is still the default printed on the router. Otherwise a long, unique Wi-Fi password can stay as it is.