Check Now
Breach research

Stop Changing Passwords Every 90 Days. Do These 3 Things Once.

October 28, 2026
Stop changing passwords every 90 days. Do these 3 things once. The edge of a computer monitor buried under years of layered yellow sticky notes, on a dark navy ground.

My bank made me change my password again last month. Third time this year. The new one is the old one with a different digit on the end, and I’ve spent 26 years in security, so I know exactly how bad that is.

Still did it. So does everyone.

So, how often should you change your password? When there’s a reason to. A breach, an infected laptop, a login you don’t recognise.

Otherwise, never.

That’s not my opinion. It’s NIST’s rule since June 2017 (we walked through the 2017 version when it was new), hardened in July 2025 from “should not” to “shall not require” periodic changes. Microsoft dropped password expiry from its own Windows baseline in 2019.

Below: our own breach data on where the timer never reached, and the three things to do once instead.

For anyone new here: XposedOrNot is the free, open-source checker I’ve run since 2017. Type in an email, see which public breaches hold it, no signup, nothing stored. Every number of ours below was pulled from the catalog (796 breaches) on 27 October 2026.

How often should you change your password?

Change a password when there’s evidence it’s been exposed, and not on a schedule. That’s the whole rule, and it comes from the body that writes the US government’s authentication standards.

The exact words in NIST SP 800-63B-4, section 3.1.1.2, published July 2025: “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.” The next sentence is the other half: “However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised.”

The 2017 version said “should not”. The 2025 version says “shall not”. In standards language that’s the difference between advice and a requirement.

And NIST isn’t alone. The UK’s National Cyber Security Centre put it more bluntly in its password guidance: “Regular password changing harms rather than improves security.”

Timeline: who dropped forced password changes and when, from the FTC in 2016 to NIST's final 2025 revision

Where the 90-day rule came from

A 1985 US Department of Defense guideline, mostly. The Password Management Guideline of 12 April 1985 (the “Green Book”) told system owners to cap a password’s life, and recommended “no greater than 1 year”.

The maths behind it assumed an attacker guessing 8.5 times a minute over a 300-baud modem line. No breach dumps, no credential stuffing, no stealer logs.

Corporate policy then shrank the one-year ceiling to 90 days, and the card-payment standard wrote it down. PCI DSS 3.2.1 (2018) required user passwords to change at least every 90 days. That one line kept the habit alive in every company that takes card payments, long after the research had moved on.

Even that has softened. PCI DSS 4.0.1, requirement 8.3.9, now reads “changed at least every 90 days” OR “the security posture of accounts is dynamically analyzed”, and neither applies where multi-factor authentication is used.

If your bank or employer still runs the timer, this is where it came from. It has nothing to do with whether your password has actually leaked, which is the only thing worth checking.

Why forced changes make passwords worse

Because people don’t pick a new password. They edit the old one.

Researchers at UNC Chapel Hill tested this on 7,752 real university accounts with their password histories (Zhang, Monrose and Reiter, ACM CCS 2010). Given one old password, their tool recovered the current one for 41% of accounts in under three seconds each. Online, with five guesses, about what a login page allows before locking, it still got 17%.

That’s the pattern a breach alert breaks. You change the one password that leaked, to something new, instead of nudging every password every quarter.

The ladder: Summer2024! to Summer2025! to Summer2026!, with the UNC figures of 41% cracked offline in 3 seconds and 17% within 5 online guesses

The FTC’s chief technologist, Lorrie Cranor, read that paper and wrote the post that started the turn in March 2016. Her title says it: “Time to rethink mandatory password changes.”

Microsoft followed in May 2019, dropping expiry from its Windows security baseline and calling it “an ancient and obsolete mitigation of very low value”. The reasoning in that post is the clearest I’ve read: “If a password is never stolen, there’s no need to expire it. And if you have evidence that a password has been stolen, you would presumably act immediately rather than wait for expiration to fix the problem.”

Two months later Alex Weinert, Microsoft’s identity security lead at the time, put complexity and expiry rules in the same bin: “Don’t do either; it’s demonstrably harmful.” His example password was Summer2019!. Mine would be too, given the bank.

What breach data says about the 90-day window

A forced change only helps if the thief waits longer than your interval to use what they stole. So I looked at the two gaps that matter, in our own catalog.

The first gap is how fast a stolen password gets used. Agari seeded more than 8,000 phishing sites with logins it controlled and watched what happened (Anatomy of a Compromised Account, June 2021). Of the accounts the thieves touched, half were opened within 12 hours and 91% within a week.

The second gap is how long it takes before anyone could tell you. Across the 138 breaches we added to our index between 1 January and 27 October 2026, the median time from the month the breach happened to the day it reached us was 62 days.

For 61 of them (44%), it was more than 90 days. For 24 (17%), more than five years.

Bar chart: of 138 breaches indexed in 2026, 77 arrived within 90 days of the breach month, 61 took longer, 24 took more than five years

Put those two gaps side by side. The thief moves in hours, and the news reaches you in months, if at all. A timer set to 90 days lands in neither window, and in the meantime you’ve typed Summer2026! into the same site that lost Summer2025!.

Now the older end of the catalog. The median breach we index happened 6.9 years ago, and 532 of the 796 (66%) are five years old or more.

Of the 518 breaches that leaked passwords at all, 289 (55%) stored them in plain text or in a hash that cracks in minutes. That’s our passwordRisk field, and the full breakdown is here.

Columns by breach year: the share of breaches that exposed passwords falls from 85% in 2016 to 11% in 2026, and the plain-text share falls with it

There’s a quieter trend in that chart. In 2016, 66 of the 77 breaches we hold from that year leaked passwords (85%). For 2026 so far, it’s 10 of 84 (11%).

In our catalog at least, sites are getting better at not losing the password at all. The leaks that still hurt are the old ones people never changed, plus the stealer logs lifted straight off an infected device.

Rotation at work doesn’t touch either. (If you’d obeyed a 90-day rule since 2010, that’s 68 new passwords, and not one of them changed the 2012 forum login you reused on your email.)

When you should change a password

Here’s the part the standards call “evidence of compromise”, translated:

Change it nowWhy
Your address shows up in a new breach that leaked passwordsThat password, and anything it was reused on, is in a file somebody is working through
A device you typed it on was infectedA stealer-log hit means malware saw it. Clean the device first, then change it, or the malware reads the new one too
You reused it anywhereOne leak at the weakest site opens the lot
You shared it, or someone watched you type itA colleague, a family login, a shoulder on the train
The service tells you toA reset you didn’t ask for, a sign-in alert you don’t recognise, a “new device” email

And the non-reasons: 90 days have passed, a headline said millions of passwords leaked (check whether yours is in that set first), it feels like it’s been a while.

Table: five reasons to change a password now and four that are not reasons

One more thing, from the NCSC’s own list of why expiry carries no benefit, that people skip past. An attacker who’s already in your account isn’t thrown out by a scheduled reset, because the reset email lands in the inbox they’re reading. So, evidence first, and then the change from a device you trust.

Do these 3 things once

Each one takes part of an afternoon. After that, you only touch a password when the table above says so.

  1. One password per site, made by a manager. The point isn’t strength, it’s blast radius: a leak at one site then opens one site. Reuse is the engine behind nearly every “hacked” account we hear about, and every measurement lands in the same band: 42 to 51% of people in a 2014 NDSS study, 52% of 28.8 million users reusing or lightly modifying a password across 107 services in a 2018 ACM CODASPY study, 52% in Google’s 2019 Harris Poll.
  2. Two-step sign-in where it matters, and a passkey where it’s offered. Email, bank, phone carrier, the password manager itself. Google’s year-long study with NYU and UC San Diego found that a code sent to your phone blocked 100% of automated bots and 96% of bulk phishing, and Microsoft’s figure from the same year is that an account with MFA is more than 99.9% less likely to be compromised.
  3. Get told when one actually leaks. This is the “evidence” half of NIST’s rule, done for you. Alert Me is our free breach alert: an email when your address turns up in a breach we’ve just indexed, so you change the one password that leaked, not thirty.

Still deciding whether to trust a password manager? I wrote about that from the breach-dump side.

Your browser has a version of the alert as well: Google’s Password Checkup and Apple’s warnings on iPhone check your saved passwords against known leaks, and in Google’s own study 26% of those warnings led to a new, stronger password. If you’re wondering about one particular password right now, our password check can tell you without the password leaving your browser.

Three cards: one password per site, two-step sign-in where it matters, get told when one leaks

Run a company? The same three apply to your staff, and free domain monitoring gives you the evidence half for every address on your own domain, with no size limit and no per-address fee.

What if work still makes you change it every 90 days?

Two things. First, use the manager to generate a brand-new password each time, so the forced change at least isn’t Summer2026!. The 41% number only works on people who edit the old one.

Second, send the policy owner three links: NIST 800-63B-4 section 3.1.1.2, the Microsoft baseline post, and Microsoft’s own password policy recommendations, which say outright that the recommended setting for cloud accounts is “for passwords to never expire”. If their reason is PCI, requirement 8.3.9 now lets them replace the timer with MFA.

Most policies survive on nobody asking. Ask.

And for your own accounts, start with the evidence. Put your address into XposedOrNot: ten seconds, no signup. If a breach with passwords comes up, that one is the password to change today.

If the free tools have been useful, a star on the GitHub repo helps other people find them. Small thing, big help.

FAQ

How often should you change your password? When something has happened to it, and not before. That means your address turned up in a breach with passwords in it, a device you typed it on caught malware, you’d reused it on a site that leaked, or the service itself warned you about a sign-in that wasn’t you. NIST’s current standard (SP 800-63B-4, July 2025) tells systems they “SHALL NOT require” scheduled changes, so a good password that hasn’t leaked can sit there for years.

Why is changing passwords often bad? Because the replacement is usually the old password with one character changed, and attackers know the patterns: given one old password, a 2010 UNC Chapel Hill study recovered the current one for 41% of accounts in under three seconds. People also pick weaker passwords when they know they’ll have to replace them soon, which NIST’s own FAQ gives as the reason it dropped the rule.

What does NIST say about password expiration? Don’t do it on a schedule. That’s been the position since the June 2017 revision, and the July 2025 revision turned it into a “shall not” for the systems that check passwords, with one required change: after evidence of compromise. NIST also wants new passwords screened against a blocklist of ones already leaked, which is a breach alert applied at sign-up rather than afterwards.

Should I change my password after a data breach? If that breach leaked passwords and yours was one of them, yes, and then on every other site where you’d used the same one. Look your address up first on XposedOrNot so you’re changing the right password rather than all of them (it shows each breach and whether a password came with it). One catch: a stealer-log entry on that list means a device was infected, and the malware scan comes before any password change.

Appendix: Sources and references

Get alerted when your email shows up in a new breach. Set up free breach alerts, it takes two minutes.

Check out some of our posts for you.

Facebook Twitter Linkedin Mastodon
| © 2026 XposedOrNot.com.