How Often Should You Change Your Password? (2026 Guidance)

If your IT department or an old habit tells you to change every password every 90 days, the modern answer may surprise you: for most accounts, don't. Security guidance has shifted. This guide explains how often you should really change a password, why forced rotation was dropped, and what to do instead.

The short answer

Do not change a strong, unique password on a fixed schedule. Change it only when there is a real reason. That is the current consensus from security bodies including NIST, which dropped routine-rotation advice back in 2017. A strong password you keep, protected by two-factor authentication, beats a stream of weaker ones you are forced to reinvent.

Why "change it every 90 days" backfires

The old rule sounded prudent, but it made things worse in practice. When people are forced to change passwords often, they don't invent strong new ones. They make small, predictable tweaks - Spring2026! becomes Summer2026! - and they reuse patterns across accounts. The result is weaker, more guessable passwords and more reuse, which is exactly what attackers count on.

When you actually should change a password

Rotation should be triggered by events, not the calendar. Change a password right away if:

• The service announces a data breach or you find your account in one.
• The password is weak, reused, or shared with anyone.
• You notice unfamiliar logins or activity on the account.
• You typed it on a phishing site or an untrusted device.
• You ever sent it to someone, even yourself, over chat or email.

In any of those cases, change it immediately and turn on two-factor authentication.

What to do instead

Routine changing is the wrong habit. These three are the right ones:

1. Use a unique password for every account. A password manager generates and stores long, random passwords so you never reuse or forget one.
2. Turn on two-factor authentication. It blocks a stolen password on its own, which matters far more than how often you rotate.
3. Monitor for breaches. Then you know exactly when a specific password genuinely needs changing - instead of guessing on a schedule.

What makes a password strong enough to keep

The whole "no routine rotation" advice rests on one condition: the password has to be strong and unique to begin with. A weak password that you keep forever is not the goal. What counts as strong?

• Length over complexity. NIST's own guidance (SP 800-63B) treats length as the main driver of strength and tells services to allow long passwords - at least 64 characters - rather than forcing odd symbol rules. A 16-character random string or a memorable passphrase of five or more random words is far harder to crack than a short password padded with ! and a number.
• Unique to one account. Reuse is what turns a single breach into many. If a password appears on only one site, a leak there can't unlock anything else you own.
• Never derived from a pattern. Company2026, your pet's name, or a keyboard walk (qwerty123) are guessable. A generated random password has no pattern to attack.

Get those three right and the password genuinely does not need a calendar reminder. For a full walkthrough, see how to create a strong password.

What if my employer forces a 90-day change?

Many workplaces still enforce periodic rotation, often because an old compliance checklist demands it - even though NIST, Microsoft and the UK's NCSC now advise against routine expiry. You usually can't override company policy, but you can keep it from making your security worse:

• Use your password manager to generate a brand-new random password each time instead of tweaking the old one. That defeats the predictable Spring → Summer pattern that makes forced rotation dangerous.
• Never reuse a retired work password on a personal account.
• If you influence policy, the documented modern position is to drop scheduled expiry and instead rotate on evidence of compromise, paired with multi-factor authentication and breach monitoring.

The point isn't to fight your IT team - it's to make sure that if you must rotate, each new password is still strong and unique rather than a recycled guess. And keep checking whether your passwords have leaked so a real trigger never goes unnoticed.

The bottom line

The honest, current answer to "how often should I change my password" is: not on a schedule - only when something happens. Forced rotation was well-meaning but it pushed people toward weaker, repeated passwords. Swap that habit for strong unique passwords, a manager to hold them, and two-factor authentication. That is what actually keeps accounts safe in 2026.