You don't need to change a strong, unique password on a schedule. Change it right away when there's a reason: a breach notice, a phishing page you typed it into, a sign-in you don't recognize, reuse on a site that got breached, or someone who knew it losing access. Otherwise, leave it alone and turn on multi-factor authentication.
This comes straight from NIST. Its digital identity guidelines, SP 800-63B, say services "SHALL NOT require subscribers to change passwords periodically" and must force a change when there's evidence the password was compromised. The old every-90-days rule did more harm than good.
When to change a password#
| What happened |
What to do |
| A company tells you your password was exposed |
Change it now, plus every other account where you used the same or a similar password |
| You entered your password on a page you now think was fake |
Change it immediately from a device you trust, and check the account's recovery settings |
| Sign-in alert, reset email, or purchase you don't recognize |
Change the password, sign out all other sessions, and review recovery email and phone |
| Someone you shared it with (an ex, a former roommate, a past employee) shouldn't have access |
Change it and remove their devices from the account |
| Strong, unique password and nothing unusual |
No change needed |
Work accounts are the exception. If your employer's system makes you rotate, you have to follow it. Just don't reuse that work password anywhere else.
Why regular password changes stopped being recommended#
When people know they'll have to change a password soon, they pick something easy and then change it in predictable ways: Summer2025! becomes Autumn2025!, Password1 becomes Password2. NIST's FAQ on password expiration explains that attackers who have an old password can guess these variations easily, so forced rotation mostly creates a false sense of security.
The same NIST guidance also tells services to stop forcing composition rules (one capital, one symbol, one number) and to check new passwords against lists of common and already-breached passwords. Length and uniqueness do the real work.
What makes a password strong#
Length first. CISA recommends passwords of at least 16 characters, random, and different for every account. A long random string like t7Qm#pe2VxK9!rLw is ideal when a password manager stores it for you.
For the handful of passwords you have to type from memory (your computer login, your password manager), use a passphrase of four or five random words: harbor-pencil-oyster-gravel-mint. Song lyrics, quotes, pet names, and birthdays are all things an attacker will try early.
Unique matters as much as long. When a site is breached, attackers take the leaked email-and-password pairs and try them on banks, email providers, and shops. This is called credential stuffing, and it only works if you reused the password. One reused password can turn a breach at a forum you forgot about into a breach of your email.
Use a password manager#
Nobody can remember 100 random 16-character passwords. A password manager generates them, stores them encrypted, and fills them in. NIST's guidelines now say services must allow password managers and autofill, which is a fair sign of where the consensus has gone.
The one built into your browser or phone (Apple Passwords, Google Password Manager) is a reasonable choice, especially if you use one ecosystem. A separate manager works better if you mix Apple, Windows, and Android devices.
Two things to get right when you set it up:
- Protect the manager with a long, unique master password and the strongest second factor it offers.
- Write down the recovery code or emergency kit and keep it somewhere safe and offline, like with your passport. Getting locked out of your own vault is the failure most people never plan for.
Turn on multi-factor authentication, starting with email#
Multi-factor authentication (MFA) means a stolen password isn't enough on its own. The FTC's guide to strong passwords and other ways to protect your accounts calls text and email codes the least secure option and recommends an authenticator app or a security key where you can. A text code is still far better than nothing.
Start with your email account. It's the reset channel for almost everything else, so whoever controls your inbox can reset your bank, shopping, and social accounts without knowing those passwords. CISA's MFA guidance puts email first, then financial accounts, shopping, and social media. Your mobile carrier account belongs on the list too. Ask the carrier for an account PIN or port-out protection, so nobody can move your number to their SIM and receive your codes.
Never read a code out to someone who called or messaged you. Your bank won't ask for it. If someone claiming to be the bank does, hang up and call the number on the back of your card.
What about passkeys?#
Passkeys replace the password with a cryptographic key stored on your phone, computer, or password manager. You unlock them with your fingerprint, face, or device PIN. Because a passkey is tied to the real website, a fake login page can't collect it, which makes it much harder to phish than a password plus text code.
Use them where they're offered, especially for email and big shopping accounts. Before you rely on one, check where it's saved and how you'd get back in if you lost your phone. A passkey synced through your password manager or Apple/Google account is easier to recover than one locked to a single device.
What to do after a data breach notice#
- Don't click the link in the email. Open the app or type the company's address yourself and confirm the notice is real.
- Change the password on that account to a new, unique one.
- Change it anywhere else you used the same or a similar password. The FTC specifically calls this out.
- Turn on MFA if it wasn't already on.
- If financial details or your Social Security number were exposed, check your credit reports and consider a credit freeze.
Do a security checkup twice a year#
Swap "password change day" for a short review of your important accounts: email, bank and cards, password manager, phone carrier, cloud storage, and the main social media accounts. For each one:
- Is the password unique? Most password managers flag reused and breached passwords for you.
- Is MFA on?
- Are the recovery email and phone number current?
- Are there old devices or sessions to sign out?
- Do you still have your backup codes?
Close accounts you no longer use while you're at it, after downloading anything you need. Fewer accounts means fewer places for a breach to hurt you. The same review fits naturally with a social media privacy audit, and keeping your devices on a regular software update schedule covers the other half of account security.
Put the checkup on a recurring reminder (ChoreLists.com can repeat it every six months), and never write the passwords themselves into the task.