Guides/Password expiration policies
Password expiration policies: pros and cons
Many workplaces once required a new password every 60–90 days. Modern guidance often preferslong unique secrets + 2FA over routine rotation that pushes people toward weak patterns.
Why forced expiry lost popularity
- Users rotate predictably:
Winter2025!→Spring2026!. - Help desks fill with lockouts; people write temporary passwords on sticky notes.
- A strong unique password that never leaked does not become “stale” on a calendar alone.
When changing still makes sense
- Confirmed or likely credential leak — seeafter a breach.
- Shared or guessed password, or one reused elsewhere —uniqueness.
- Offboarding: revoke access; do not rely on waiting for expiry.
Better defaults
- Password manager + long random strings —manager vs memory·length.
- MFA on email and SSO; monitor login alerts.
- Local draft checks only —safe checks.