(Credit: designer491; iStock/Getty Images Plus)
In the past, whenever I wrote about security passwords, I would say something along the lines of "Use password managers, as they make it very easy to change passwords, which you should do frequently." Because that's the advice everyone gives about passwords, along with making them strong and unique to every service and account you create.
I haven't done that in years, though, because our resident security expert, Neil. J. Rubenking, pointed out to me that the "should do frequently" part is sorely outdated advice.
When the National Institute of Standards and Technology (NIST) issued Digital Identity Guidelines in 2017, it used a lot of science talk to discuss information security standards and "memorized secrets"—its term for passwords, passphrases, and personal identification numbers (PINs). Its conclusion: "Do not require that memorized secrets be changed arbitrarily (e.g., periodically) unless there is a user request or evidence of authenticator compromise."
The NIST report also includes an appendix on the Strength of Memorized Secrets, which discusses how it's almost impossible for people to memorize passwords when they're forced to follow "composition rules," such as including a symbol, an uppercase letter, or a numeral.
"The benefit of such rules is not nearly as significant as initially thought, although the impact on usability and memorability is severe," NIST said.
The length of a memorized secret is more important than complexity. Yet so many services reject extra-long passphrases. (NIST says people should be allowed up to 64 characters.)
Nothing beats memorization for security, but after a couple of years online, you could have hundreds of passwords to keep in your brain. That way lies madness. Ultimately, the best advice for anyone dealing with password security is to use a password manager so you only have to remember one master password or phrase.
NIST agrees; its 2024 update to the Digital Identity Guidelines recommended password managers and has other suggestions for services and organizations that require passwords. Those include enabling "show password" since it's highly unlikely anyone is hovering behind you to write it down, which reduces typing mistakes; locking out users after multiple failed attempts; monitoring for the use of dumb, overused passwords; and employing multi-factor authentication. Now, passkeys (private keys stored on your device, like a phone) are also a better option. But you're still stuck with passwords in many places.
Don't Lie: How Often Do You Change Passwords?
The advice to change your password often is so ingrained in the online culture that February 1 has been dubbed Change Your Password Day. I say: Do not celebrate!
The story I wrote years ago about passwords that spurred all this included coverage of a survey in which PCMag specifically asked, "How often do you change your passwords?" At the time, 74% of respondents reported changing their passwords at least every six months.
I didn't buy it then, and I don't buy it now. The cynic in me thinks people believe they are supposed to change passwords often and don't want to admit to us (or themselves) that they don't.
Or perhaps they're annoyed because their workplace or a service requires frequent changes. I know I always am.
Stop feeling guilty! The experts told us years ago to quit making regular password changes. It's time we listened. As long as your password is already reasonably strong and unique to every site and service, changing it frequently is not much help to you.
Unless it's compromised in a data breach, of course. Then change it immediately.
Alas, You Can't Fight Forced Password Changes
This good advice won't stop certain entities from forcing you to change your password. Your boss or bank may take persuading to cease showing that dreaded "Please enter a new password to continue" message every few months. There's not much you can do about that. They're paranoid, and for good reason, as 81% of data breaches have been traced to poor passwords.
But the keyword there is poor. You can and should make passwords that are strong and unguessable. We have tips for memorizing them.
Institutions that require changes probably won't let you reuse a password either, even if it's the strongest you've ever created. They're probably also going to continue limiting the size and requiring special characters; they may not even allow a passphrase, which is extra secure, because it's longer. (Yes...size matters.)
Sorry. We can't change your company or financial institution's policies.
Just remember: If you have a really good password for a service or account, if you're not forced to change it, you can probably keep it for life (until there's a breach). Just ensure it's long, strong, and unique.