Still Changing Your Password Every Ninety Days? That Advice Was Formally Withdrawn

Almost everybody carries a set of password rules learned somewhere around 2005: rotate every quarter, mix in a symbol and a digit, never write anything down, and pick a security question only you could answer. They were sincerely meant and reasonable given what was known at the time. Most of them have since been withdrawn by the same institutions that popularized them, and what replaced them is shorter, easier to follow, and better matched to how accounts are actually broken into now. That is rarely by somebody guessing at a keyboard. The gap between the old advice and the current advice is where a lot of avoidable trouble still lives.

Scheduled Rotation Made Passwords Worse Rather Than Better

Forced ninety-day changes were meant to limit how long a stolen credential stayed useful, and in practice they produced predictable human behavior instead. People took a password they could remember and appended a number, then incremented it, so an attacker holding one old password could usually derive the current one in a handful of tries. Current guidance is to change a password when there is a reason, meaning a breach, a shared credential, or a suspicion that something is wrong, and otherwise to leave a strong unique password alone. Rotation without cause spends attention that would be better invested in the two changes that actually matter.

Complexity Rules Traded Length for Symbols, Which Was a Bad Deal

The requirement to include an uppercase letter, a digit and a punctuation mark was an attempt to enlarge the space an attacker has to search, and it worked far less well than expected because people satisfied it in the same few ways. Capital at the front, digit at the end, exclamation point after that. Length turns out to be the variable that matters, and a passphrase of four or five unrelated words is both far harder to attack and considerably easier to type on a phone than an eight-character string full of substitutions.

That shift is visible on login screens now. The National Institute of Standards and Technology sets the digital identity guidelines that most federal systems and a great many private services follow, and its move away from mandated character classes is why the box demanding a symbol has been quietly disappearing from account signup forms over the past several years. Anywhere the old rules survive, the sensible response is to satisfy them with a long phrase and one appended character rather than to shorten the phrase in order to fit more punctuation into it.

Writing Passwords Down Was Never the Real Risk

The instruction never to write a password down assumed a coworker reading a sticky note. For most households that is not the danger. The realistic threat is an automated attempt to reuse credentials stolen from some unrelated service, and defending against it requires every account to hold a different password, which is well beyond what anybody remembers. A password manager is the practical answer, and a written record kept somewhere physically secure is a reasonable one, particularly for the handful of credentials that have to survive a lost phone. Both beat the alternative, which is one password on forty sites.

A Strong Password Alone Stopped Being Sufficient Some Time Ago

Strength protects against guessing and does nothing whatever against theft, and theft is how most accounts fall now. A password entered on a convincing imitation of a login page is compromised regardless of how long it is, which is why a second factor has become the single most valuable change available to an ordinary household. An app that generates codes or a physical key is meaningfully stronger than a text message, since text messages can be redirected by somebody who persuades a carrier to move a number, but any second factor is a large improvement over none. If only two accounts get one, make them the email account and the account that holds the money.

The reason to begin with email is that the mailbox is the master key to everything else. Password resets for banks, retailers, utilities and tax accounts all arrive there, so an attacker holding the mailbox has a working path into every service that trusts it, and that dependency stays invisible until somebody demonstrates it on your account. Protecting the mailbox first also has the useful side effect of showing you how the second factor behaves before you apply it anywhere that would be painful to lose access to.

Security Questions Are a Password Written in Public

Mother's maiden name, first pet, high school: these were designed as a memory aid in an era when the answers were genuinely private, and they now sit in obituaries, on social profiles, and in the public record. Treated as what they actually are, a second password with a weaker recovery path, the sensible approach is to answer them with random strings stored alongside the password rather than with the truth. Where a service allows the question to be replaced with a real recovery method, an authenticator app or a backup code printed and filed, take that option and stop using the question at all.

What the Current Advice Adds Up To

The modern version is short enough to say in three sentences. Use a long unique passphrase for every account and let software remember them, turn on a second factor for the mailbox and the money first and everything else over time, and change a password when something has actually happened rather than because a quarter has ended. That is less work than the 2005 rules demanded, not more, which is part of why it holds up better in practice.

The old habits were not foolish and the people who followed them were not careless; the threat simply moved and the guidance moved with it, more quietly than the original advice had arrived. Anybody still rotating passwords on a calendar and answering honest security questions is defending diligently against the attacks of two decades ago, and the good news buried in that is how little effort it takes to catch up. One evening spent installing a manager and switching on two factors leaves a household in better shape than years of dutiful quarterly changes ever did.