If you learned to use computers in the 2000s, someone almost certainly told you to change your password every 90 days. Your bank enforced it. Your employer's IT team enforced it. And most of us grumbled and turned Summer2019! into Summer2019? and called it security. That advice was wrong then, and in 2026 it is actively dangerous.
Here is the surprising part: the organization that popularized the 90-day rule, the US National Institute of Standards and Technology (NIST), formally reversed itself. Its current digital identity guidelines (SP 800-63B) explicitly tell organizations not to force periodic password changes unless there is evidence of compromise. The reason is simple. When you make people rotate passwords on a schedule, they pick weaker, more predictable ones and reuse patterns across accounts. Forced rotation trades a small, theoretical benefit for a large, measurable one.
So the real question in 2026 is not "how often should I change my passwords" but "which passwords should I change, when, and why." This article gives you a clear framework, a worked example with real numbers, a comparison of rotation strategies, and a step-by-step plan you can run this weekend.
Key Takeaways
- Stop rotating on a calendar. Changing every password every 90 days is outdated advice that leads to weaker passwords.
- Change immediately on trigger events: a breach notification, malware infection, phishing click, or a shared device.
- Length beats rotation. A unique 16+ character passphrase you never reuse is stronger than a short password you rotate monthly.
- Reuse is the real enemy. One reused password can cascade into 20 compromised accounts through credential stuffing.
- Use a password manager and enable MFA or passkeys so rotation becomes a two-minute task, not a chore.
- Tier your accounts by sensitivity and treat email and financial logins as critical infrastructure.
Why the "Change Every 90 Days" Rule Is Dead
The 90-day rule made sense in an era of short passwords, no breach monitoring, and no multi-factor authentication. Back then, an attacker who stole a password hash might take months to crack it, so rotating gave you a moving target.
Modern reality is different in three ways:
- Attackers move in minutes, not months. Credential-stuffing bots test stolen passwords against thousands of sites within hours of a breach. Rotating in 90 days does nothing against a same-day attack.
- Forced rotation degrades password quality. Studies from the UK's National Cyber Security Centre found that users given rotation mandates create predictable sequences (
Spring1,Spring2,Spring3) that are trivial to guess. - Better defenses exist. Multi-factor authentication, passkeys, and breach monitoring provide protection that periodic rotation never could.
The NCSC put it bluntly: regular password expiry does more harm than good. Their guidance, and NIST's, both landed on the same conclusion. Change a password when you have a reason to, not because a timer went off.
When You Absolutely Should Change a Password
Rotation still matters. It just needs a trigger. Change a password immediately when:
- A service reports a breach that involves your account or its password database.
- You clicked a phishing link and entered credentials, even if you caught it a second later.
- Your device was infected with malware, especially an infostealer. If a stealer ran on your machine, assume every saved credential leaked.
- You shared the password with a contractor, a family member, or a temporary team member who no longer needs access.
- You used the password on a shared or public computer, such as a hotel business center or library.
- You reused it somewhere and one of those places was compromised.
How Often to Change Passwords: A Tiered Framework
Instead of one blanket schedule, sort your accounts into tiers based on what an attacker gains by owning them. This is how security professionals actually think.
Tier 1: Critical Infrastructure
These are the accounts that can unlock everything else: your primary email, your password manager, your phone carrier account, and your primary bank. Your email is the master key because most "reset password" links land there.
- Rotation: Only on trigger events, but audit these every 6 months.
- Requirements: 20+ character unique passphrase, hardware-backed MFA or passkey, no SMS-only recovery.
Tier 2: Sensitive Accounts
Secondary financial accounts, work SaaS logins, cloud storage, and anything storing personal documents or payment methods.
- Rotation: On trigger events; audit annually.
- Requirements: 16+ character unique password, MFA enabled.
Tier 3: Low-Stakes Accounts
Forums, newsletters, one-off shopping sites, and throwaway registrations.
- Rotation: Almost never, unless the site is breached.
- Requirements: Unique password generated by your manager. The uniqueness is the whole point here, so a breach on a forum never touches your bank.
If you run websites of your own, the same tiering logic applies to admin logins. A WordPress or Joomla admin account belongs firmly in Tier 1, which is why hardening tools like eDarpan WordPress Protection and Joomla Copy Protection Pro exist to add layers beyond the password itself.
A Worked Example: The 47-Password Audit
Let's make this concrete. Say you have 47 passwords across your digital life, spread across 12 categories, and you have no idea which are safe. Here is exactly how to triage them in about an hour.
Step 1: Export your inventory. Open your password manager and look at the list. If you don't have one, that is problem number one. Say your 47 accounts break down like this:
- 3 critical (email, bank, password manager)
- 9 sensitive (work apps, cloud storage, PayPal, secondary bank)
- 35 low-stakes (shops, forums, apps)
Step 2: Run a breach check. Most managers have a built-in "compromised password" report powered by Have I Been Pwned. In our example it flags 8 accounts as breached and 14 as reused. That overlap is where the danger lives.
Step 3: Fix the critical overlaps first. Suppose your email password is unique and strong but your bank password is reused on two shopping sites, one of which appears in the breach list. That is a five-alarm fire. Change the bank password now, then the shopping sites, then verify MFA is on.
Step 4: Batch the rest. Change the remaining reused and breached passwords, prioritizing Tier 2 over Tier 3. In our scenario:
- Reset 3 breached Tier 2 passwords (15 minutes)
- Reset 5 breached Tier 3 passwords (15 minutes)
- Replace 9 reused-but-not-breached passwords over the next week during normal logins
Before: 14 reused passwords, 8 breached, no MFA on 6 accounts.
After: 0 reused, 0 known-breached, MFA on all Tier 1 and Tier 2. Total hands-on time: roughly 55 minutes.
Notice what you did not do: rotate all 47 on a schedule. You fixed the 22 that actually mattered and left the safe ones alone.
Rotation Strategies Compared
Not every approach is equal. Here is how the common strategies stack up on the criteria that matter.
| Strategy | Security | Effort | Password Quality | Best For |
|---|---|---|---|---|
| Calendar rotation (every 90 days) | Low | High | Poor (predictable) | Legacy compliance only |
| Trigger-based rotation | High | Low | Strong | Most individuals |
| Unique passwords + MFA | Very High | Medium setup, low upkeep | Strong | Anyone with a manager |
| Passkeys (passwordless) | Highest | Low once set up | N/A (no password) | Modern accounts that support it |
| Reused passwords, no MFA | Critical risk | Low | Irrelevant | Nobody |
The winning combination for 2026 is unique passwords managed by a tool, layered with MFA, and moving toward passkeys where supported. Rotation becomes an exception, not a routine.
The Setup That Makes Rotation Painless
The reason people hate changing passwords is that they are doing it manually, from memory. Fix the workflow and the whole problem shrinks.
1. Adopt a Password Manager
A manager generates a unique 20-character password per site and fills it automatically. When a breach hits, you change one entry, not a dozen. Before you commit your entire vault to one, though, it is worth understanding how to audit your password manager's encryption so you know exactly what protects your data at rest.
2. Turn On Multi-Factor Authentication Everywhere
MFA means a stolen password alone is useless. Prefer app-based codes or hardware keys over SMS, which is vulnerable to SIM-swapping. Enable it on every Tier 1 and Tier 2 account first.
3. Move to Passkeys Where You Can
Passkeys replace passwords with cryptographic keys tied to your device. There is nothing to phish and nothing to rotate. They are not bulletproof, though. Malware that targets your device can still be a threat, so read up on how to protect passkeys from mal
Cover image: Software value feedback loop by jakuza, licensed under BY-SA 2.0 via Openverse.
