Why is changing your password regularly not a good idea?

One of the most enduring pieces of password security knowledge is that changing your passwords regularly increases security. At least, that's what IT teams around the world have been pushing on people for decades.

However, that advice has always been met with resistance. Many in the security industry argue that this leads to passwords that are easy to remember. Now, research has proven this theory, demonstrating that frequently changing passwords can lead to security problems.

Changing passwords frequently leads to poor security

Many of us find mandatory password changes every 4, 6, or 8 weeks intimidating. One IT group promotes the idea that changing your password will make any security breaches irrelevant, since everyone will use new passwords.

In practice, this leads to weaknesses in password creation. Instead of creating strong, unique, and hard-to-guess passwords, most people choose passwords that are easy to remember with small, repeated parts.

For example, a strong 16-character password might be "hS'9{yX?Fzu#=_:R", which includes a mix of uppercase and lowercase letters, numbers, and symbols. It's hard to remember, but over time, you'll get the hang of it. Whereas if you had to change your password every month, you wouldn't have time to remember it. So people started using easier-to-remember phrases with small, repeated parts.

• January: difficultpassword1
• February: d1fficultpassword2
• March: d1ff1cultp4ssword3
• V,v...

Choose strong, unique passwords (or use a password manager)

The UK's National Cyber ​​Security Centre has recommended against using regular passwords since 2015, and now, in 2024, the National Standards Institute is following suit.

Their new advice recommends passwords expire every 365 days, significantly changing the timeframe — and increasing security.

At the same time, NIST is also updating its messaging on password length and strength. In some cases, password creation rules limit users to 12 characters or prevent certain symbols from being used. NIST now recommends that all passwords:

• Minimum 15 characters
• Maximum 64 characters
• Includes all ASCII characters, whitespace characters, and Unicode characters

These changes mean more password entry fields will allow for stronger and more memorable passphrases, while overall password strength is also increased.

Of course, any organization that cares about password security should enable the use of a password manager. There are additional security considerations involved with using a password manager, such as local data storage, zero-knowledge encryption, etc., but it's a best practice to protect all of your accounts with strong passwords.