Password Rotation: Why the Old 90-Day Advice Changed

For 20+ years, the standard security advice was: force employees to change their passwords every 90 days. It was written into every compliance framework. It was baked into Active Directory defaults. It was on every security awareness training deck. Then, quietly, the research caught up with the practice — and every serious guidance body reversed the recommendation. NIST no longer requires periodic password rotation. Microsoft removed it from Windows security baselines. Every current best-practice guide says: don’t force periodic rotation.

This guide walks through why the advice changed, what to do instead, when password changes are still required, and how to update your organization’s password policy from the old model to the current best practice.

The old advice: change passwords every 90 days

For decades, the standard was:

Force password change every 30-90 days
Password complexity requirements (mix of upper/lower/number/symbol)
Minimum length 8 characters
Password history (can’t reuse last 5-10 passwords)

The logic: if a password gets stolen, forcing rotation limits how long the attacker has access. Sounds reasonable.

Why the advice changed

Research showed the old approach actually made security WORSE:

Human behavior

When forced to change passwords frequently, users:

Use predictable patterns (Password1! → Password2! → Password3!)
Write passwords on sticky notes / in unprotected notes apps
Reuse the same password across systems (change one, change all)
Make transformations too weak to matter (adding a number)

The predictability actually made passwords easier to guess. Studies showed forcing rotation reduced password strength by 20-40% in practice.

Attacker economics

Password rotation was designed for a world where attackers get a password and want to maintain access for months. Modern attacks are different:

Credential-stuffing attacks use stolen passwords within HOURS of the breach, not months.
Compromised credentials are typically used within days.
Long-term persistence is achieved through backdoors, not password reuse.

Rotating passwords every 90 days doesn’t stop the attack — attackers finished their work weeks earlier.

Modern authentication

Multi-factor authentication (MFA), passkeys, hardware security keys, and behavior-based access controls now provide the security that periodic rotation was meant to enforce. Password rotation is 1998 security in a 2026 threat landscape.

The current best-practice guidance

NIST SP 800-63B (updated 2017; reaffirmed 2020)

The federal standard for authentication. Key changes:

Do NOT require periodic password changes.
DO require password changes when compromise is suspected.
Minimum length 8 characters (some contexts require more).
Check passwords against known-compromised lists (Have I Been Pwned integration).
Do NOT enforce complex character composition rules.
DO allow long passphrases.
Allow paste from password managers.

Microsoft Windows 10/11 Security Baseline

Microsoft removed the “maximum password age” recommendation from its baselines in 2019. The Windows security team explicitly states periodic rotation is not recommended.

NCSC (UK) and Cyber Essentials

Same guidance: don’t rotate periodically; rotate on compromise; use MFA.

CISA (US) and cybersecurity insurance industry

Modern security guidance and cyber insurance controls: MFA + strong-unique-password + monitoring — not periodic rotation.

What to do instead — the modern password model

1. Length over complexity

A 15-character passphrase (“correct-horse-battery-staple”) is astronomically stronger than an 8-character complex password (“P@ssw0rd”) — and easier to remember. Modern policy: minimum 12-15 character passphrases, no complexity requirements.

2. Unique per system

Every application/service = unique password. Enforced by password manager (no one can remember 200 unique passwords, so use a tool). See our best password managers for small business.

3. Multi-factor authentication (MFA)

Mandatory for every system that supports it. Prefer:

Authenticator apps (Microsoft Authenticator, Google Authenticator, Authy)
Hardware keys (YubiKey) for privileged accounts
Push notifications with number-matching for phishing resistance
SMS as last resort (SIM-swapping vulnerable)

4. Passkeys (passwordless)

Passkeys eliminate passwords entirely, replacing them with device-bound cryptographic credentials. Increasingly supported across major platforms. See our passkeys for small business guide.

5. Check against compromised password databases

When users set new passwords, check against Have I Been Pwned’s list of compromised passwords. Reject any that appear. Prevents credential-stuffing exposure.

6. Rotate only when triggered

Passwords change when:

Compromise suspected or confirmed
User leaves the organization (change/disable ex-employee credentials immediately)
Shared password used to onboard someone (change after they set their own)
Breach notification from a service you use
User forgets password (reset, not rotate)

Otherwise, strong passwords + MFA don’t need periodic changing.

When periodic rotation IS still required

Some compliance frameworks still mandate periodic rotation:

PCI-DSS

Payment Card Industry standard historically required 90-day rotation. Recent versions (PCI DSS 4.0, 2022) relax this to allow risk-based approaches — but only if you can demonstrate compensating controls. Most PCI-scoped organizations still rotate to avoid audit friction.

Some healthcare (HIPAA-adjacent) contracts

Individual HIPAA has no explicit periodic-rotation requirement. But some healthcare payer or partner contracts still specify rotation. Contract terms trump general guidance.

Some government contracts (CJIS, DoD)

Criminal Justice Information Services and Department of Defense (specifically FIPS 200 / older NIST guidance) still require rotation for certain systems. See our CMMC compliance for defense contractors — some CMMC controls still assume rotation.

Some cyber insurance policies

A minority of cyber insurance underwriters still ask about periodic password rotation as a control. Increasingly rare; check your specific policy.

When required by compliance or contract, comply. Just don’t apply rotation broadly because “that’s what we’ve always done.”

Updating your organization’s password policy

If your current policy requires 90-day rotation, updating steps:

Check regulatory/contractual requirements — is rotation mandated for any specific system?
Update written policy — periodic rotation removed for systems not subject to specific requirements. Rotate-on-compromise policy documented.
Adjust technical controls — remove maximum password age from Active Directory / Entra ID / directory services (or set to a very long duration like 365+ days as symbolic buffer).
Enable MFA on everything that supports it. This is the actual security control replacing rotation.
Roll out password manager if not already deployed. Unique-per-service passwords require a tool.
Add breach monitoring — integrate Have I Been Pwned or equivalent to detect if company credentials appear in known breaches.
Employee communication — explain the change. Users often think “why are you making my life easier?” Explain the security rationale (MFA + strong unique passwords > rotation).

Communicating the change to employees

Employees often distrust “we’re making rules less strict” as a signal that security is weakening. Frame the change correctly:

Explain the research — rotation actually reduced security by encouraging weak patterns.
Emphasize what REPLACES rotation: MFA everywhere, password manager, breach monitoring.
Position as “modern security” not “less security.”
Provide clear rules on when passwords DO change (compromise, offboarding, forgot).

Password requirements checklist (modern policy)

What a 2026-appropriate password policy contains:

Minimum length: 12-15 characters (some contexts higher)
Passphrase encouraged; complexity not required
Unique per system (enforced via password manager)
Screened against Have I Been Pwned or equivalent
Password manager provided by employer
MFA required on all systems supporting it
Rotation ONLY on trigger (compromise, offboarding, forgot)
Failed login lockout (5-10 attempts → temporary lockout)
No password sharing; each user has their own credentials
No storage in plaintext (memory, browser autofill for non-managed devices, files)

Common questions from stakeholders

“Won’t attackers keep using old passwords forever if we don’t rotate?”

Only if the password is compromised. Rotation is a random reset that catches nothing. Continuous monitoring for compromised credentials + immediate reset on any breach = actual protection.

“Our auditor still asks about rotation”

Modern auditors accept risk-based approaches. Show them NIST 800-63B guidance, your compensating controls (MFA, monitoring, password manager). Some auditors haven’t updated; educate them or note it as an audit finding with a documented risk acceptance.

“Our old cyber insurance application asks about rotation”

Answer honestly. If they still require rotation, comply. But shop insurance — current market is increasingly aligned with modern guidance.

“What if a device is lost or stolen?”

Trigger immediate password reset for that user + revoke any device tokens/certificates. MDM enables remote wipe. See our how to secure remote workers.

Common password mistakes (regardless of rotation policy)

Reusing passwords across systems. One breach = many compromised accounts. Password manager solves this.
Writing passwords on sticky notes. Password manager solves this.
Sharing passwords via email or chat. Use password manager sharing features or delegate access via IdP, not shared credentials.
Using default or example passwords in production. Never leave “admin/admin” or “password/password” in place.
Skipping MFA because it’s inconvenient. MFA is the actual security. Skipping it = false sense of security.
Password-only for admin accounts. Admin/privileged accounts need hardware key MFA, not just app-based.

Key takeaways

Periodic password rotation (90-day mandatory changes) is no longer recommended by NIST, Microsoft, NCSC, or modern security frameworks.
Rotation actually reduced security by encouraging weak, predictable password patterns.
Modern approach: long passphrases + unique per system + password manager + MFA + rotate-only-on-trigger.
Still-required rotation: PCI (in most implementations), some healthcare/DoD contracts, some cyber insurance policies. Comply where mandated.
Employee communication matters — frame policy change as MODERN security, not LESS security.

FAQ

My IT auditor still requires 90-day rotation — what do I do? Comply, but educate. Provide NIST SP 800-63B and current Microsoft Windows Security Baseline documentation. Some auditors will update; others won’t. Document your compensating controls (MFA everywhere, breach monitoring, password manager) as risk mitigation. Auditor push-back is decreasing year by year.

What length passphrase is actually secure? Modern recommendation: 12-15 characters minimum. NIST allows 8-character minimum but the industry has moved to longer. For privileged/admin accounts, 16-20 characters. Passphrases (four random words = “correct-horse-battery-staple” style) are easier to type and remember than complex passwords while being cryptographically stronger.

Should we still change passwords when employees leave? Absolutely — but disable/delete the ex-employee’s accounts rather than rotating their password. If they had shared or admin credentials, rotate those. Also revoke MFA tokens, session cookies, and any device certificates. See our recover hacked Microsoft 365 account for the parallel process when accounts are actually compromised.

Password Rotation: Why the Old Advice Changed