Forcing password changes makes systems less secure

A prompt appears on the screen. It tells the employee that their password expires in three days. This sight is common in offices across the globe and has been for decades.

For a long time, this was standard practice. The logic seemed sound. If a criminal stole a password, they could use it to enter a system and steal data. By forcing a change every ninety days, the window of opportunity for that thief closes automatically. It felt like a safety net. A regular reset ensured that any leaked credentials became useless before too much damage occurred. In an era where passwords were often short and simple, frequent rotation was a reasonable defence against the slow leak of credentials.

The predictable pattern#

Humans are not designed to generate random strings of characters every few months. When forced to change a password frequently, most people take the path of least resistance. They apply a simple transformation to their existing password. A string like “PasswordSpring2024!” becomes “PasswordSummer2024!”.

This is an efficient way to satisfy a computer system, but it is a gift to a hacker. Once an attacker identifies one old password from a previous leak, they can guess the next several iterations with very little effort. The security measure intended to lock out the thief instead provides them with a map of future passwords. There is a certain creative genius in how users find the shortest possible route to compliance, even if that route leads straight back to the attacker.

Furthermore, forced rotation encourages poor habits. A person who must change their password four times a year is more likely to write those passwords on a sticky note attached to the monitor or store them in an unencrypted text file on the desktop. The pressure to rotate creates a tension between security and usability that the user almost always resolves by sacrificing security.

A change in perspective#

Security experts eventually noticed this behaviour. The National Institute of Standards and Technology, known as NIST, updated its guidelines in the SP 800-63B publication. Similarly, the National Cyber Security Centre in the UK dropped the requirement for periodic rotation. These organisations recognised that forced changes often lead to weaker passwords overall.

The shift in thinking acknowledges that a long, complex password that remains unchanged is far more secure than a series of short, predictable passwords that change every quarter. The risk created by these habits is greater than the risk of a password remaining valid for a longer period.

Instead of following a calendar, an organisation should focus on evidence of compromise. This means changing a password only when there is a reason to believe it has been stolen. A data breach at a third-party site or a detected phishing attack are legitimate reasons to reset credentials. When passwords are long and complex, they remain secure for much longer than ninety days.

Using a password manager helps here. These tools store long strings that the user does not need to remember. This removes the temptation to use seasonal patterns or write passwords on scraps of paper. The goal is to move away from a schedule and towards a response based on actual risk.

Remove any policy that forces periodic password changes. Instruct staff to keep their current passwords unless there is evidence of a breach. Encourage the use of a password manager to ensure each account has a unique, long string.