For years, many experts considered password expiration an unquestionable good practice. Organisations forced users to change their password every 30, 60 or 90 days, in the belief that this increased security. Today, however, international recommendations have changed significantly, and leading bodies no longer advise mandatory periodic expiration as a general rule.
In this article, we explain what password expiration procedures are, why the recommendations have changed, in which situations expiration still makes sense and which alternatives offer greater security. In addition, we present a practical example, a checklist and answers to frequently asked questions.
What is password expiration
Password expiration is a rule that requires users to change their password after a certain period or following certain events. The original aim was to limit the time during which an attacker could use a stolen password.
In theory, the idea makes sense. In practice, however, experience has shown that frequent, mandatory changes have side effects that reduce security rather than increase it.
Why the recommendations have changed
NIST guidelines in the United States no longer recommend mandatory periodic password changes, and the most recent versions state that organisations should not require them without evidence of compromise. Other leading cybersecurity bodies have followed the same approach. There are essentially three reasons:
- Predictable passwords: when forced to change them frequently, users make small changes, such as swapping a number at the end, which attackers can predict.
- Insecure notes: frequent changes lead many people to write passwords down on paper or in unprotected files.
- Limited protection: an attacker who steals a password usually uses it quickly, long before the expiry date.
Consequently, periodic expiration imposes a real cost on users without a proportionate security gain.
When expiration still makes sense
Abandoning periodic expiration does not mean that users should never change their passwords. On the contrary, there are situations in which a change should be immediate or mandatory:
| Situation | Recommended procedure |
|---|---|
| Suspected or confirmed compromise | Immediate change and review of account activity |
| Password found in a data leak | Mandatory change at next sign-in |
| Temporary or initial password | Short expiry and change at first access |
| Privileged and service accounts | Rotation managed by a credential vault |
| Departure of an employee with access to shared accounts | Change of shared credentials |
These expiration procedures are risk-based and, therefore, far more effective than a blanket rule applied to all users.
The alternatives that really increase security
Multi-factor authentication
This is the measure with the greatest impact. Even if an attacker discovers the password, they still need a second factor to get in. Whenever possible, it is best to choose authenticator apps, physical security keys or passkeys, which are more resistant to phishing than SMS codes.
Long, screened passwords
Instead of complex composition rules, current recommendations favour length. In addition, the platform should reject passwords that appear on lists of compromised credentials or that are too obvious.
Password managers
A password manager makes it possible to use long, different credentials for each service without relying on memory. For this reason, it is one of the most useful tools for employees. Indeed, many organisations provide a corporate password manager, which allows credentials to be shared in a controlled way when this is genuinely necessary.
Monitoring and response
Systems should detect suspicious access attempts and alert the security team. In this way, when there are signs of compromise, the system requires a password change at the right moment.
What about the GDPR?
The GDPR does not require periodic password changes. Instead, under Article 32, it requires technical and organisational measures appropriate to the risk. In practice, multi-factor authentication, access control and monitoring are more effective measures and easier to justify in an audit than periodic expiration.
External users and shared platforms
On document management platforms used by contractors, many users do not belong to the organisation. They are administrative staff from small companies who log in occasionally and sometimes share accounts with colleagues. In this context, periodic expiration is even less effective: users forget their password, constantly request resets and end up writing it down in insecure places.
For this reason, the best approach is to assign individual accounts, prohibit credential sharing and enable multi-factor authentication. Furthermore, when the relationship with a contractor ends, the organisation should immediately deactivate the associated accounts. In this way, access control depends on the account lifecycle rather than on arbitrary expiry dates.
How to communicate the policy change
Many users and auditors still associate periodic expiration with good practice. So, when removing it, it is advisable to clearly explain the reasons and the new measures that replace it. For example, an internal note can state that the organisation follows current international recommendations, that multi-factor authentication is now mandatory and that passwords are checked against known data leaks. Likewise, the written security policy should be updated so that the decision is documented and justified for audits.
Indicators to monitor
To assess the impact of the new policy, the organisation can track the percentage of accounts with multi-factor authentication, the number of password reset requests, passwords blocked because they appear in data leaks and alerts of suspicious access. In general, after the change, reset requests fall and multi-factor authentication coverage rises, which shows a real gain in security and productivity.
Practical example: Reviewing the password policy
Imagine a company that required all users of its document management platform to change their password every 60 days. Access reset requests were constant and many users had passwords such as “Company2025!” followed by sequential numbers.
The company decides to review the policy: it removes periodic expiration, requires passwords of at least 12 characters, enables multi-factor authentication and starts checking passwords against lists of known leaks. As a result, reset requests fall significantly and account security improves.
Password expiration checklist
- Mandatory periodic expiration removed for standard users.
- Immediate change in case of suspected compromise.
- Screening against lists of compromised passwords.
- Temporary passwords with short expiry.
- Managed rotation of privileged and service accounts.
- Multi-factor authentication for all users.
Common mistakes to avoid
A frequent mistake is removing periodic expiration without enabling multi-factor authentication, leaving accounts protected by the password alone. Another mistake is keeping overly strict complexity rules, which lead to passwords that are hard to remember and easy to guess from patterns. Finally, many organisations forget service accounts, whose credentials are never changed or stored securely.
Frequently asked questions
Should I remove periodic expiration now?
Yes, provided that the organisation enables multi-factor authentication and compromised password screening at the same time. Without these measures, the change should be accompanied by a reinforcement plan.
Do administrator accounts also stop expiring?
Privileged accounts require special treatment. In many cases, credential vaults manage these accounts and rotate them automatically, so people do not have to memorise them.
What if an auditor requires periodic changes?
It is advisable to present the updated policy and the international references that support it, as well as the compensating measures adopted, such as multi-factor authentication and monitoring. In most cases, auditors accept this justification because it demonstrates a risk-based approach.
What is the recommended minimum length?
Current guidelines point to at least 8 characters when multi-factor authentication is in place and, preferably, 15 or more when the password is the only factor. In practice, long passphrases are more secure and easier to remember.
Conclusion
For a long time, mandatory periodic password expiration was common practice. Today, we know that it tends to produce weaker passwords and more frustration, without a proportionate security gain.
Therefore, organisations should adopt risk-based expiration procedures, combined with multi-factor authentication, long passwords, password managers and monitoring. In this way, they protect accounts better, make life simpler for users and reduce the support costs associated with access resets.
Read also: Brute force attacks on digital platforms and Distributing personalised credentials to approved workers.
For further recommendations on secure credential management, consult the Portuguese National Cybersecurity Centre (CNCS).