A Policy That Feels Secure but Isn't
"Change your password every 90 days, with at least one uppercase letter, one number, and one symbol" is probably the single most common password rule in corporate policies — and it's also one of the most thoroughly debunked. It feels rigorous. It looks good in a compliance checklist. But when researchers actually studied what happens when people are forced to change passwords on a fixed schedule with no evidence of compromise, the results were clear: people don't pick a genuinely new password, they make a small, predictable tweak to the old one.
The Predictable Pattern Problem
Ask almost anyone who's been forced to rotate a password quarterly, and you'll hear a version of the same story: "Summer2024!" becomes "Summer2025!" becomes "Summer2026!". The core password barely changes. Anyone who learns one password in the sequence — through a breach, a shoulder-surf, or a guess — can often predict the next one. Forced rotation, instead of improving security, quietly trains people to make their passwords more guessable over time.
What Current Guidance Actually Recommends
NIST SP 800-63B, the standard many organizations look to for password guidance, moved away from forced periodic rotation years ago — and the reasoning has only gotten stronger since. The modern approach rests on three pillars instead:
- Length over complexity. A long passphrase like a random sequence of unrelated words resists guessing and cracking far better than a short password stuffed with substituted symbols.
- MFA as the primary defense. Multi-factor authentication protects an account even when a password is guessed, phished, or leaked in a breach — something no amount of password complexity can do on its own.
- Rotation on evidence, not on a calendar. Passwords should be changed immediately when there's a specific reason to believe they've been compromised — not on an arbitrary 90-day timer.
Why Complexity Rules Backfire Too
Mandatory character-class rules (must include uppercase, must include a number, must include a symbol) have a similar problem to forced rotation. Faced with a rule like this, most people take the shortest path to compliance: a dictionary word with an uppercase first letter, a "1" at the end, and an exclamation point. "Password1!" satisfies every rule and is still one of the first guesses any attacker would try. A longer, unconstrained passphrase is both easier to remember and dramatically harder to guess.
Making the Switch Without Causing Confusion
Moving an organization off forced rotation and mandatory complexity can feel counterintuitive to employees who've been trained for years to see those rules as "more secure." The policy itself needs to explain the reasoning, not just state the new rules — otherwise people will assume the change is a shortcut rather than an upgrade. Pairing the new policy with an MFA rollout at the same time reinforces the message: you're not removing a safeguard, you're replacing a weak one with a stronger one.
What to Keep, What to Drop
A modern, defensible policy keeps: a meaningful minimum length (14+ characters is a reasonable target), a strong recommendation or requirement for MFA everywhere it's available, and a rule to change a password immediately upon suspected compromise. It drops: fixed-schedule forced rotation, mandatory character-class complexity, and password reuse across systems.
One Caveat Worth Checking
Some regulatory or contractual frameworks — certain interpretations of PCI-DSS, for instance, or specific customer contracts — may still require periodic rotation regardless of current security guidance. Before fully removing rotation from your policy, confirm whether any compliance obligation specific to your industry still mandates it.
Rolling Out the New Policy
When you switch an existing organization over to this approach, don't wait for the next scheduled password change to explain the new rules — communicate the change proactively, with the reasoning attached. Pair the rollout with an MFA enrollment push if MFA isn't already universal, since that's the control doing most of the real protective work. A short internal FAQ addressing "why did the 90-day reminder stop" head-on avoids the impression that security standards have quietly relaxed, when the opposite is true.
Frequently Asked Questions
Yes — the Organization Password Policy Generator produces a ready-to-adopt password policy built on current best-practice guidance (length + MFA over forced rotation and complexity rules). It's a one-time $5.99 purchase — no subscription, no account required.
Forced rotation on a fixed schedule with no evidence of compromise consistently leads people to make small, predictable tweaks to an existing password rather than choosing a genuinely new one — which makes passwords easier to guess, not harder. Current guidance, including NIST SP 800-63B, recommends rotating only after a known or suspected compromise.
Yes. The forced-rotation toggle can be switched on if a specific compliance requirement applies to your organization — the generated policy will include that rule along with a note about the trade-off, so you can decide with full context.
MFA is on by default and treated as the primary defense against account compromise, but it can be toggled off if your organization isn't ready to require it — the generated wording adjusts automatically either way.
No. It's general security guidance, not legal or compliance advice. Some regulatory frameworks may impose specific password requirements — confirm your obligations and have the policy reviewed by your security or compliance team before adopting it.