For about two decades, "change your password every 90 days" sat alongside "eat your vegetables" in the canon of unquestioned advice. IT departments enforced it, compliance checklists demanded it, and banks nagged you about it. Then the people who wrote the rule took it back. NIST - The US standards body whose guidance underpins most password policy - Removed scheduled password expiration from its recommendations in 2017's SP 800-63B, and its 2025 revision states the position even more plainly. Microsoft dropped the expiration requirement from its Windows security baseline in 2019, calling it "an ancient and obsolete mitigation." The UK's National Cyber Security Centre had said the same even earlier.
So how often should you change your password in 2026? The honest answer: on a trigger, not a timer. This article covers where the 90-day rule came from, why it backfired, the specific events that should make you change a password immediately, and what to do instead of rotating.
Where the 90-day rule came from
The rule dates back to early computing environments - The folklore points at 1970s–80s mainframe guidance - Where the threat model was an attacker slowly brute-forcing password hashes offline. If cracking a hash took roughly a few months of computer time, changing the password every few months meant the cracked value might be stale before it was usable. The logic was coherent for that era.
Every assumption behind it has since collapsed. Modern GPU rigs crack weak hashes in hours or minutes, not months, so a 90-day window is theater against offline cracking. And most compromised passwords today aren't cracked at all - They're phished, stolen by infostealer malware, or dumped in plaintext from breached databases, then used within hours or days. A password stolen on Tuesday and abused on Wednesday doesn't care that you were going to rotate it in June.
Why forced rotation made things worse
The killer evidence against scheduled changes wasn't just that they stopped helping - It's that they actively hurt. Studies of real users (notably UNC Chapel Hill's analysis of expired-password datasets, which NIST cites) found that when people are forced to change passwords regularly, they don't create fresh random ones. They apply transforms:
Falcon#7→Falcon#8→Falcon#9Summer2025!→Autumn2025!→Winter2025!- increment a digit, move a symbol, capitalize a different letter
Cracking tools ship with exactly these transform rules. The UNC researchers could predict a user's next password from a previous one in a large share of cases - Meaning an attacker holding an expired password often derives the current one almost instantly. Rotation converted "one strong password" into "a family of weak related passwords," while also driving helpdesk resets, sticky notes, and password reuse across sites.
A calendar can't tell whether your password was stolen. Breach alerts, login notifications and monitoring can. Rotate when they fire - Not when a quarter ends.
When you SHOULD change a password - Immediately
Retiring the schedule doesn't mean passwords are forever. These events are the new triggers, and when one fires you should change the affected password the same day:
| Situation | Change the password? | Also do this |
|---|---|---|
| Service announces a breach, or you get a breach-alert email | Yes - Immediately | Change it anywhere you reused it; enable 2FA |
| Your email appears in Have I Been Pwned | Yes, for the breached accounts | Review other accounts sharing that password |
| You typed your password into a suspicious site or link | Yes - Immediately | Check for new forwarding rules / sessions |
| Malware or an infostealer was found on your device | Yes - Every password used on that device | Change them from a clean device |
| You shared it (person, chat, sticky note) and access should end | Yes - When the need ends | Prefer proper sharing methods next time |
| A roommate, ex-partner or ex-employee had access | Yes | Also rotate shared Wi-Fi and streaming logins |
| Unrecognized login alert or sessions you don't recognize | Yes | Sign out all sessions; review recovery info |
| Nothing happened; it's just been a year | No - If it's strong, unique, and 2FA-protected | Spend the effort enabling 2FA elsewhere |
Two of these deserve emphasis. First, breach exposure: you can check your email address against known dumps at haveibeenpwned.com, which indexes billions of breached accounts, and most password managers now run this check continuously. When you get a hit, our step-by-step guide on what to do after a data breach walks through the full cleanup, because changing one password is rarely the whole job. Second, the malware case: if a device was infected, change passwords from a different, clean device - An infostealer will happily capture the replacements too.
What to do instead of rotating
The modern regime replaces scheduled effort with one-time effort. Do these four things and the "how often" question mostly disappears:
- Make every password long, random and unique. A stolen password from site A should open nothing else. Sixteen random characters from a password generator, or a four-to-five-word passphrase for anything you must type from memory, puts brute-force out of reach. If you're unsure whether an existing password makes the grade, run something similar to it through a strength checker and look at the estimated crack time.
- Store them in a password manager so uniqueness is actually sustainable. Our complete password manager guide covers free and paid options honestly.
- Turn on two-factor authentication on email, banking, and anything you'd cry about losing. With 2FA, even a stolen password isn't enough on its own.
- Turn on the alarms. Login notifications, breach monitoring, and account-activity emails are your triggers - The things that tell you when a change is actually warranted.
One password is worth extra ceremony: your email account. It's the reset key for everything else, so give it your best password and your strongest second factor.
Special cases and honest exceptions
Compliance-bound accounts. Some frameworks still mandate rotation - PCI DSS 4.0 keeps a 90-day requirement for certain accounts unless compensating controls exist. If your work account is in scope, the schedule isn't optional for you personally; follow it with fresh random passwords.
Shared and service credentials. Passwords known by multiple people - The office Wi-Fi, a team's social media login, a service account - Should rotate whenever someone with knowledge departs. Since there's no reliable "evidence of compromise" signal for a secret several humans know, an occasional scheduled rotation (say, annually, plus every offboarding) is reasonable here. This is the one context where calendars still earn their keep.
Routers and defaults. Any default password - Router admin, IoT gadgets, a new laptop from IT - Should be changed once, immediately, then treated like any other strong credential.
High-value targets. If you're a likely target (executive, admin, journalist, crypto holder), lean on hardware security keys and passkeys rather than more frequent password churn. Rotation adds little against a targeted phish; phishing-resistant factors add a lot.
The bottom line
Change your password when something happens: a breach notice, a phish, malware, a departure, a weird login. Don't change it because a date arrived. Then spend the energy you used to spend on quarterly rotation making each password strong, unique, stored in a manager, and backed by 2FA - That combination is what actually ended the 90-day era.
FAQ
So I never have to change my passwords again?
You change them on evidence, not on schedule. A long, random, unique password with two-factor authentication can safely last for years if no trigger fires. But when a trigger does fire - Breach notification, phishing slip, infected device, shared access ending - Change it the same day, not at your convenience.
Why do some banks and workplaces still force 90-day changes?
Institutional inertia and lagging compliance frameworks. Some standards (parts of PCI DSS, older internal audit checklists) still contain rotation language, and large organizations change policy slowly. Being forced to rotate doesn't make it good practice; comply where required, and use a freshly generated random password each cycle rather than a tweak of the old one.
Is changing passwords frequently harmful even if I use random ones?
If a machine generates a genuinely random new password each time and a manager stores it, frequent changes aren't dangerous - Just pointless effort. The harm documented in the research comes from human behavior under forced rotation: predictable increments, weaker base passwords, reuse and write-downs. Most people aren't disciplined enough to rotate randomly forever, which is why the guidance changed.
How do I know if my password was in a breach?
Check your email address on haveibeenpwned.com, which aggregates known breach dumps, and enable its notification service so future breaches alert you automatically. Most password managers and major browsers also flag saved passwords that appear in breach corpora. Treat any hit as a same-day trigger for the affected accounts and anywhere the password was reused.
Should I change all my passwords after one site is breached?
Only the breached account and every account sharing that password - Which, if you've been reusing one password broadly, might genuinely mean most of your accounts. That cleanup is the moment most people finally adopt a password manager: migrate account by account, letting it replace each reused password with a unique random one as you go.