Should passwords expire?

For decades cybersecurity professionals held tight to the idea that passwords needed to be changed on a regular basis. In recent years, however, organizations such as NIST and Microsoft have abandoned this longstanding best practice and are now recommending against mandatory password expiration.

1. When should passwords expire?
2. Why should passwords not expire?
3. Do I really need to change my passwords?
4. Should you change passwords every 90 days?

When should passwords expire?

In this day and age, changing passwords every 90 days gives you the illusion of stronger security while inflicting needless pain, cost, and ultimately additional risk to your organization.

Why should passwords not expire?

If a strong password never expires -- and the password is never compromised through theft or attack -- the user never has to change that password. As for the password itself, longer is better.

Do I really need to change my passwords?

Cybersecurity experts recommend changing your password every three months. There may even be situations where you should change your password immediately, especially if a cybercriminal has access to your account.

Should you change passwords every 90 days?

Passwords should also be unique for each account. pim recommends changing passwords every 90 days (about 3 months). According to Thytoctic, 80% of all cyber security attacks involve a weak or stolen password. Changing your password quarterly reduces your risk of exposure and avoids a number of IT Security dangers.