If you have been changing your passwords every 90 days because someone told you that was good security, you can stop. Password rotation on a fixed schedule is no longer recommended, and the organization that wrote the original rule is the one that reversed it.

What replaced it is simpler and works better: keep a strong, unique password for every account, and change it when something actually happens that warrants it.

Why the advice on password rotation changed

Scheduled expiry was standard for decades. Every 30, 60, or 90 days, systems forced everyone to pick something new. The intent was reasonable — if a password leaked, rotation limited how long it stayed useful.

In practice, people did what people do. Faced with a new password every quarter, they made the smallest possible change: Spring2024! became Spring2025!, Password7 became Password8. Anyone who had the old password could guess the new one in a couple of tries. Worse, the constant churn pushed people toward simpler passwords they could remember, and toward reusing the same one across sites.

The National Institute of Standards and Technology now states the position plainly in SP 800-63B: systems shall not require users to change passwords periodically, and shall force a change only when there is evidence a password has been compromised.

The takeaway is not that changing passwords is bad. It is that changing them on a timer substitutes ritual for security, and the ritual makes real security harder.

When you should change a password

Five situations genuinely call for it.

1. The service was breached

If a company you have an account with discloses a breach, change that password immediately — even if the company says passwords were encrypted. Check whether your email address appears in known breaches at Have I Been Pwned, which indexes billions of exposed credentials.

2. You reused it somewhere

A password used on more than one site is only as safe as the least careful site holding it. Attackers take credentials leaked from one breach and try them everywhere else, a technique called credential stuffing. Every reused password is worth replacing, starting with your email account.

3. It is weak or ancient

Short passwords, dictionary words, names, and dates fall quickly to automated guessing. A password you created a decade ago was probably built to rules that no longer make sense. Length matters more than symbol soup — a long passphrase beats a short password full of punctuation.

4. Something looks wrong

A login alert you did not trigger, a password reset email you did not request, unfamiliar activity on the account. Change it, then turn on two-factor authentication if it is not already on.

5. Someone else knew it

A shared streaming login when a housemate moves out, a work account after someone leaves the team, a password you read aloud over the phone to support. Once a password has left your control, rotate it — this is the one case where the old instinct is exactly right.

What to do instead of rotating on a schedule

Make every password unique. This is the single change that matters most. Unique passwords mean one breach stays one breach instead of cascading through every account you own.

Let a generator do the work. Nobody can invent and remember a hundred distinct passwords. mSecure generates them, stores them encrypted, and fills them in when you need them, so uniqueness costs you nothing.

Audit instead of expiring. mSecure’s Security Center analyzes the passwords in your vault and shows you which ones are weak or duplicated. That list is your actual to-do list — far more useful than a calendar reminder telling you to change everything, including the passwords that were fine.

Add a second factor. Two-factor authentication does more for account security than any rotation schedule. mSecure 7 stores one-time codes alongside the login they belong to, so the code is right where you need it. See the features page for what is included in each plan.

Use passkeys where they are offered. A passkey cannot be phished, guessed, or leaked in a breach, because there is no shared secret to steal. Support is growing quickly across major services, and mSecure 7 handles them alongside your passwords.

If you set policy for a team

The same guidance applies, and the update is overdue in a lot of organizations.

Retire forced expiration. Screen new passwords against lists of known-compromised credentials, which NIST recommends in place of complexity rules. Require multi-factor authentication, especially for email and administrative accounts. Keep a documented process for revoking access when someone leaves, since offboarding is the moment rotation genuinely matters. And give people a password manager, because a policy that depends on human memory produces sticky notes.

One caveat worth knowing: some compliance frameworks and auditors still ask for periodic expiry. If yours does, you may have to keep it regardless of what the guidance says. It is worth asking whether the requirement has been updated — several have.

The bottom line

Password rotation was a reasonable answer to a real problem, and better answers exist now. Change a password when there is a reason: a breach, reuse, weakness, exposure, or anything suspicious. The rest of the time, your effort is better spent making sure every password is unique and strong, and that a second factor stands behind the ones that matter.

mSecure handles the part that does not scale by hand — generating passwords, keeping them encrypted, and showing you which ones actually need attention. For more on staying ahead of threats without the busywork, browse the rest of the mSecure blog.