For decades the standard advice was to change your password every ninety days. It was in every policy, enforced by every corporate system, and repeated in every security awareness session.
Research showed it made things worse, and the guidance reversed. Plenty of organisations still enforce it, and plenty of people still believe it, which is why it is worth stating clearly what happened.
What changed in 2026
- The revised guidance became mainstream. Recommending against arbitrary rotation moved from expert consensus into general practice.
- Compliance frameworks caught up unevenly. Some standards continued to require rotation, so organisations enforced it despite the evidence.
- Passkey adoption reduced the question's relevance. Where passkeys replace passwords, rotation does not apply.
- Breach notification improved. Better detection made evidence-based changes more practical than calendar-based ones.
Why rotation backfired
The mechanism is behavioural and entirely predictable.
Told to choose a new password every ninety days, people do not generate a genuinely new strong one. They make the smallest change that satisfies the system: increment a number, swap a symbol, add a season.
That produces a predictable sequence. Someone who obtains one password can frequently guess the next, which is precisely the situation rotation was meant to prevent.
It also drives passwords weaker overall, because a password you must change repeatedly needs to be easy to modify and remember, which means simple. And it increases writing them down in insecure places, because remembering a genuinely new strong password every quarter is unreasonable.
| Intended effect |
Actual effect |
| Limits the window of a compromised password |
Predictable increments defeat this |
| Encourages fresh strong passwords |
Encourages weak modifiable ones |
| Improves security posture |
Increases writing them down |
What to do instead
Change on evidence, not on schedule. A service reports a breach, you see unfamiliar activity, you shared a password, or you suspect compromise. Those are reasons. The calendar is not.
Use unique passwords everywhere. This is the change that matters most. Reuse is what turns one breach into many compromised accounts, and it is the actual mechanism behind the majority of account takeovers.
Prioritise length. A long passphrase is stronger and more memorable than a short string with substitutions. Complexity requirements pushed people toward short awkward passwords when length was the more valuable property.
Use a password manager. Once you are not remembering them, passwords can be long, random, and unique — which removes the constraint that made all the old advice necessary. See the best password managers.
Move important accounts beyond passwords. Passkeys and security keys sidestep the question entirely and resist phishing, which passwords do not — see security keys explained.
Common mistakes
- Rotating on a schedule for personal accounts. No benefit, real cost.
- Incrementing rather than replacing. Predictable.
- Reusing across services. The single largest risk.
- Short complex passwords over long simple ones. Length wins.
- Not changing after a known breach. The one time you should.
- Security questions with truthful answers. Public facts as credentials — see account recovery planning.
- Leaving email on a weak password. It recovers everything else.
FAQ
My employer requires rotation. What do I do?
Comply, and use a password manager so each rotation produces a genuinely new random password rather than an increment. That removes most of the harm the policy causes.
When should I actually change a password?
On a reported breach, on suspicious activity, after sharing it, after using it on a device you no longer trust, or if it was reused and one service was compromised.
Are password managers safe?
They concentrate risk and reduce it overall, because the alternative is reuse or weak passwords. Protect the manager itself well — a strong unique passphrase plus a security key, and recovery codes stored offline.
What about passkeys?
They replace passwords for supporting services and resist phishing in a way passwords cannot. Where available they are the better option — see passkeys vs 2FA.
Where to go next
For managing unique passwords practically, read the best password managers. For moving beyond passwords, security keys explained, and for the recovery paths that undermine strong passwords, account recovery planning.