🔄 Should You Change Your Password Every 90 Days? What NIST Actually Says (2026)

Your IT department is wrong — and the US government's top standards body agrees with that statement. NIST SP 800-63B, the federal standard governing authentication, explicitly tells organisations to stop forcing periodic password rotation unless there is evidence of a specific compromise. Yet millions of employees are still being forced to create a new password every 90 days, a policy that 25 years of security research consistently links to weaker passwords, not stronger ones.

What Is Password Rotation?

Password rotation is the practice of replacing an existing password with a new one at a set interval. In enterprise environments, this is typically enforced through Active Directory or an identity provider — employees receive an expiry notice and must create a new password before logging in again. Common rotation intervals are 30, 60, and 90 days, with 90 days having become the de facto enterprise standard during the 2000s.

The concept applies equally to individual users who follow personal security advice ("change your email password every few months") and to automated systems where service accounts rotate credentials on a schedule. The underlying idea sounds intuitive: if you change your password regularly, a stolen password becomes worthless before long. As we will see, that logic breaks down in the real world.

Where the 90-Day Rule Came From

The 90-day rotation policy was never the result of a security study that proved it improved outcomes. It emerged from military and government computing norms in the 1980s, when systems lacked multi-factor authentication, breach detection was non-existent, and passwords were shared via paper printouts. The US Department of Defense adopted periodic rotation as a precaution, and commercial IT inherited the practice through products like Windows NT's Group Policy, which offered 90-day expiry as a default setting.

For two decades, the policy went largely unquestioned because it felt responsible — changing passwords frequently should help, right? The problem is that security intuitions are often backwards, and this one turned out to be a textbook example.

What NIST SP 800-63B Actually Says

In 2017, NIST issued a landmark update to its Digital Identity Guidelines (SP 800-63B) that reversed decades of received wisdom. The 2024 revision reinforces those findings. On mandatory periodic rotation, the guidelines are unambiguous:

"Verifiers and CSPs SHOULD NOT require users to change passwords periodically. However, verifiers SHOULD force a change if there is evidence of compromise of the authenticator." — NIST SP 800-63B (2024), Section 5.1.1.2

The reasoning is rooted in human behaviour, not abstract theory. When users are forced to change a password they have memorised, they make predictable and minimal changes: they increment a number (Summer2025! becomes Summer2026!), shift a symbol (Password1! becomes Password2!), or add a suffix. These patterns are well documented in academic literature and are already built into cracking dictionaries used by real attackers.

NIST's position is supported by the UK's National Cyber Security Centre (NCSC), which updated its own guidance in 2023:

"Regular password changing harms rather than improves security. Many of these changes are predictable: a password is changed to something very similar, which attackers can exploit." — NCSC, Password Administration for System Owners (2023)

Both agencies now recommend the same alternative: use long, unique, randomly generated passwords that never need to be memorised — and therefore never need to be changed on a schedule.

Why Forced Rotation Makes Security Worse

The case against mandatory rotation rests on three well-documented failure modes:

1. Users predictably weaken their passwords

A 2010 study by researchers at Carnegie Mellon University analysed 51 million leaked Yahoo passwords and found that when users were forced to change passwords, the new passwords were structurally similar to the old ones in over 80% of cases. Attackers armed with the old password could guess the new one in under five attempts using simple transformation rules. The study was a turning point in how the security community viewed rotation policies.

2. Rotation has no effect on already-stolen credentials

If an attacker has your password today and you rotate it in 47 days, you have been compromised for 47 days. The attacker may have already escalated privileges, implanted persistence, or exfiltrated sensitive data. Rotation does not undo any of this. Worse, the median time to detect a data breach in 2025 was 194 days according to the IBM Cost of a Data Breach report — meaning the credential has almost certainly been used long before the next rotation date.

3. It displaces effort from genuinely useful security habits

Password fatigue is real. When users spend cognitive energy managing rotation cycles across dozens of accounts, they are less likely to use a password manager, less likely to notice breach notifications, and more likely to write passwords down or reuse them across personal and work accounts. Security effort is not unlimited, and mandatory rotation burns it on a practice that delivers no measurable benefit.

When You SHOULD Change a Password

Rejecting arbitrary rotation does not mean passwords should live forever. There are specific, evidence-based triggers that warrant an immediate change:

The Better Alternative: Make Rotation Unnecessary

The most effective solution to the rotation problem is to eliminate the conditions that make rotation feel necessary in the first place. That means using passwords that are:

• Long: At least 16 characters. NIST recommends supporting passwords up to 64 characters or more.
• Random: Generated by a cryptographically secure random number generator, not chosen by a human brain that gravitates toward patterns.
• Unique: Never reused across two different accounts. If one site is breached, no other account is affected.

A password like X9k#mP2qTvLs!wRn generated by a tool such as our free password generator satisfies all three criteria. An attacker who obtains it from a breach cannot guess what your other passwords look like, cannot apply transformation rules to derive variants, and cannot reuse it anywhere else. There is no meaningful security benefit to rotating such a password on a schedule.

To store hundreds of unique random passwords without memorising any of them, a password manager is essential. Tools like NordPass generate, store, and autofill strong credentials across all your devices, removing the human memory constraint that originally made rotation feel necessary.

What About Multi-Factor Authentication?

MFA is the single most effective control that makes password rotation even less important. When a second factor — an authenticator app, a hardware key, or a biometric — is required at login, a stolen password alone cannot compromise an account. Microsoft's security team has stated that MFA blocks over 99.9% of automated account-takeover attacks.

NIST SP 800-63B categorises phishing-resistant MFA (FIDO2 passkeys and hardware security keys) as the gold standard, placing it above SMS-based codes, which remain vulnerable to SIM-swap attacks. If your high-value accounts support hardware keys or passkeys, enabling them should take priority over any password rotation schedule.

Practical Guidance for Individuals and IT Teams

For individuals

• Generate a unique, random password for every account — use a password generator, not your own brain.
• Store them in a reputable password manager so you never need to memorise or reuse them.
• Enable MFA on every account that supports it, preferring an authenticator app or hardware key over SMS.
• Subscribe to breach notification services such as Have I Been Pwned, and change only passwords for accounts that appear in actual breach data.
• Ignore arbitrary rotation reminders unless one of the specific triggers in the table above applies.

For IT and security teams

• Remove mandatory periodic password expiry from Group Policy and identity provider settings. Replace it with breach-triggered reset workflows.
• Integrate your authentication system with leaked-credential databases (NIST recommends checking new passwords against known breach lists at the time of creation).
• Deploy phishing-resistant MFA across all privileged accounts as a priority; this eliminates far more risk than any rotation schedule.
• Enforce minimum length (at least 12 characters, ideally 16+) and ban commonly used passwords rather than arbitrary complexity rules.
• Monitor for anomalous login behaviour — geography, device, and time-of-day signals — to detect compromise without relying on rotation as a backstop.

The Bottom Line

Mandatory 90-day password rotation is a legacy policy that survives on institutional inertia, not on evidence. NIST, the NCSC, and the broader security research community reached the same conclusion over a decade ago: forcing users to change memorised passwords on a schedule produces weaker credentials, not stronger ones. The predictable substitution patterns users resort to when creating a new password are already exploited by attackers.

The right strategy is simple: generate a long, random, unique password for every account once, store it in a password manager, add MFA, and only change it when a specific compromise event occurs. That approach is both easier for users and more effective against the credential-theft attacks that dominate the modern threat landscape.