Should passwords expire every 90 days?

Modern guidance advises against arbitrary periodic expiry, because it tends to produce weaker, predictable passwords. Change passwords on evidence of compromise, and rely on length and MFA instead.

Is length or complexity more important?

Length. A long passphrase is generally both stronger and easier to remember than a short, complex string. Pair it with MFA and breach-screening.

Security fundamentals

What makes a good password policy?

In short

Modern guidance (from NIST SP 800-63B) favors longer passwords and passphrases over forced complexity, screening passwords against known-breached lists, dropping arbitrary periodic rotation, and layering multi-factor authentication on top. Length and MFA beat complexity rules.

Definition

A password policy is the set of rules governing how people create and manage passwords. A good modern one prioritizes length, breach-screening, and multi-factor authentication over the old complexity-and-rotation approach.

Background

Current guidance, notably NIST SP 800-63B, changed the old playbook. It favors longer minimums and passphrases, and letting people use long, memorable phrases. It recommends screening new passwords against lists of known-breached credentials, and it advises against arbitrary periodic expiry (which tends to produce weaker, predictable variations) unless there is evidence of compromise. Above all, it treats multi-factor authentication as the control that matters most, because even a strong password can be phished.

Why it matters

Weak and reused passwords are behind a large share of breaches. A policy aligned to modern guidance is both more secure and less annoying, which means people actually follow it, and MFA dramatically reduces the impact of a stolen password.

Step by step

Set a sensible minimum length and allow long passphrases (and the full character set).
Screen new passwords against known-breached password lists.
Stop forcing arbitrary periodic resets; require a change on evidence of compromise.
Require multi-factor authentication, especially for privileged and remote access.
Encourage or provide a password manager so unique passwords are practical.

Examples

A company drops 90-day forced resets, raises the minimum length, screens against breached lists, and enforces MFA everywhere.
Admins are required to use hardware-backed MFA for privileged access.

Common mistakes

Forcing complex characters and frequent resets, which pushes people toward weaker, predictable passwords.
Treating a strong password as sufficient without MFA.
Allowing password reuse across systems with no manager to make uniqueness feasible.

FAQ

Should passwords expire every 90 days?: Modern guidance advises against arbitrary periodic expiry, because it tends to produce weaker, predictable passwords. Change passwords on evidence of compromise, and rely on length and MFA instead.
Is length or complexity more important?: Length. A long passphrase is generally both stronger and easier to remember than a short, complex string. Pair it with MFA and breach-screening.

Do this in Keel, not a spreadsheet

Keel is the AI-native GRC platform for SMBs: one control-and-evidence graph across SOC 2, ISO 27001, HIPAA, PCI DSS, NIST CSF, and more. Start free, no credit card.

Start free See pricing