How Often Should You Change Your Passwords?

For decades, people were told to change passwords every 30, 60 or 90 days. Current guidance from security bodies such as NIST and the UK's National Cyber Security Centre is different: change a password when there is a reason, not on a timer.

Why routine changes stopped being recommended

When people are forced to change passwords often, they make small, predictable edits: adding 1 to a number, changing a season or a month. Attackers who obtain an old password can guess the new one easily. Frequent changes also push people towards shorter, simpler passwords they can remember.

When you should change a password immediately

• The service tells you it has had a data breach.
• Your email appears in a breach notification service.
• You notice suspicious activity: unknown logins, password reset emails you did not request or messages you did not send.
• You entered your password on a phishing site.
• You shared the password with someone who should no longer have access, such as a former employee.
• You used the password on a public or shared computer.
• You reused the password on another site that was breached.

A better routine

Instead of changing everything every few months, do a short security check twice a year:

1. Run your password manager's security report.
2. Replace any weak or reused passwords with ones from a password generator.
3. Confirm two-factor authentication is on for email and banking.
4. Remove accounts you no longer use.

What about workplace policies?

Some organizations still require scheduled changes for compliance reasons. Follow your employer's policy, but use a password manager so each new password can be random rather than a variation of the old one.

Frequently asked questions

Should I do a password change after a breach?

Yes. A password change after breach notifications is essential for the affected account and anywhere you reused that password. Outside those events, frequent scheduled changes are no longer recommended.

What is a password audit?

A password audit is a review of all your saved passwords to find weak, reused or compromised ones. Most password managers include a security report that does this automatically. Run one twice a year.