Password expiration policy
Also known as: password expiry policy, forced password changes, password rotation policy, password aging
A password expiration policy requires people to change their passwords after a set period, such as every 90 days.
For years, this was standard practice in businesses. Research showed that forced changes lead people to choose weaker, predictable passwords, such as adding a number at the end, so security agencies including NIST in the US and the Canadian Centre for Cyber Security now recommend changing passwords only when there's evidence of compromise. While dropping expiration sounds less secure, combining long passwords with MFA and breach monitoring works better.
Password expiration policy, explained at three levels
At home
A password expiration policy is like a building that changes everyone's door code every three months. The idea is that if a code leaks, it soon stops working. In practice, people tired of new codes pick obvious ones, like adding one to the last number, or write them on a sticky note. Thieves who know the pattern simply guess the next code.
At work
A password expiration policy forces staff to change their passwords on a schedule, such as every 90 days. It was meant to limit how long a stolen password works. Research showed people respond with predictable tweaks that attackers guess easily, so NIST and the Canadian Centre for Cyber Security now advise changing passwords only after a suspected compromise and relying on MFA instead.
At home
Expiration policies assume that a stolen password should only work for a limited time. Every 60 or 90 days, the system forces a change, so an attacker holding an old password eventually loses access. In practice, people facing constant changes make predictable tweaks, such as Spring2026! becoming Summer2026!, and attackers know those patterns. Attackers also use stolen passwords within hours, long before any scheduled change would help.
At work
NIST SP 800-63B, Microsoft and the Canadian Centre for Cyber Security now recommend against routine expiration, and require changes only when there is evidence of compromise. Microsoft 365 sets new tenants' passwords to never expire. Stronger replacements include MFA for every account, minimum length of at least 15 characters for single-factor passwords under NIST's 2025 revision, banned password lists, and leaked credential detection, such as Entra ID Protection.
At home
The most important password change is the one you make in response to an event: a site announces a breach, you typed your password into a suspicious page, or someone you no longer trust may know it. Changing it then cuts off real access, while changing on a calendar mostly just creates new passwords to remember. In my view, that kind of change is the only one that really matters, as long as your passwords are unique.
At work
Remove routine expiration where your compliance obligations allow, and force resets on evidence of compromise, such as leaked credential alerts or risky sign-ins. Require MFA everywhere, enforce minimum length rather than composition rules, and block common and breached passwords. Some frameworks and auditors still expect expiration, so document the rationale with references to NIST and CCCS guidance. Moving to passkeys removes the debate for supported apps.
Real-world examples
At home
Aisha's old employer forced password changes every 60 days, so she just changed the last digit each time. Her new employer requires a long passphrase and MFA instead.
At work
Thomas's Ottawa MSP removed 90-day password expiry for a client, added MFA and leaked-password protection, and documented the change against NIST guidance for the auditor.
How it compares
| feature | Old practice | Modern guidance |
|---|---|---|
| Password changes | Every 60 to 90 days | Only when compromised |
| Typical passwords | Short, predictable variations | Long passphrases |
| Main protection | Frequent changes | MFA and breach detection |
| User frustration | High | Lower |
Long passwords plus MFA beat frequent forced changes.
For analysts
When policies still require expiration, I'd present the NIST and Cyber Centre guidance to leadership. Updating outdated rules improves security and morale at once.
History & origin
Regular password changes became common advice in the 1980s and 1990s, influenced by government security guidance, and many businesses adopted 60- or 90-day expirations. Studies in the 2010s, including research at the University of North Carolina published in 2010, showed people made predictable changes that attackers could easily guess. NIST's 2017 digital identity guidelines advised against routine expiration, and Microsoft removed password expiration from its Windows security baselines in 2019. NIST's 2025 revision went further, stating systems should not require periodic changes. Some older compliance frameworks and cyber insurance forms still ask about expiration. In my view, forced password changes are a classic case of security theatre that made things worse.