Quick answer: Modern password policy has reversed many rules we believed for years. According to the current guidance from the US standards body NIST (SP 800-63B), the most important changes are: 1) Do not force periodic password changes (like every 90 days) because it pushes people toward predictable small changes; a password should be changed only if it is suspected of being breached. 2) Mandatory complexity rules (must have !@#1Aa) are no longer recommended; what matters is length. 3) Use at least 12-15 characters instead of 8, preferably a passphrase (four to five random words). 4) Instead of hint questions and periodic resets, check the entered password against known breached password lists. In short, the modern rule is three words: long, unique, not breached. Add multi step verification (MFA) to these and you have today's gold standard for password security.

Most of what we think we know about password security is now wrong. Rules like "change every 90 days" and "add uppercase, a number and a symbol" were repeated for decades, but research showed most of them actually reduce security. This guide explains current, evidence based password policy with world class clarity.

Old rule, modern rule

OLD RULE → MODERN RULE (NIST 800-63B) OLD · WRONG MODERN · RIGHT Force change every 90 daysDo not change unless breached Complexity required (!@#1Aa)Length matters, use a passphrase 8 characters is enoughAt least 12-15, a long passphrase Hint questions / periodic resetCheck against breached password lists Modern rule: long + unique + not breached. Forced periodic change pushes people to weak passwords.

The logic of the change is simple: people comply with rules, but in insecure ways. When you say "change every 90 days," a person turns Pass1 into Pass2; when you say "make it complex," they write P@ssw0rd. Modern policy accepts human behavior and focuses on what really works: length and uniqueness.

Right and wrong password rules

Wrong (old) Right (modern) Why
Force change every 90 days Change only on breach Forced change pushes to weak patterns
Require !@#1Aa complexity Prioritize length A long phrase beats a complex short one
8 characters is enough At least 12-15 characters A short password is cracked fast
Same password everywhere Unique per account One leak opens them all
Hint questions (mother's maiden) No questions, use MFA Hints are easily found
Memorize Use a password manager Humans cannot memorize unique passwords

Modern password policy for organizations

  1. Set a length minimum. At least 12, preferably 15 characters; encourage passphrases.
  2. Remove forced periodic change. Change only on suspected breach.
  3. Add breached password checking. Reject if the user enters a known breached password.
  4. Loosen complexity mandates. Focus on length.
  5. Provide a password manager for the organization. Unique passwords are only possible this way; see our password manager guide.
  6. Require MFA. Even if a password leaks, 2FA/passkey protects the account.

Why forced change is harmful is that, as in our password cracking article, users make predictable small changes; if the attacker found one password, they find its variation too.

Frequently asked questions

Don't I need to change my password regularly? No, it is no longer recommended. Without a breach suspicion, changing a strong unique password does not improve security and even pushes people to weak patterns. If it leaks, change it immediately.

Is a complex password (numbers, symbols) safer? Length matters more than complexity. A long phrase like "four random words" is far stronger than a short complex password and is easier to remember.

What is a passphrase? A long password made of four to five random words (for example unrelated words). It is both very long/strong and memorable by a human.

Do these rules apply outside NIST? Yes. The NIST guidance is a global reference, and modern security standards move in the same direction: length, uniqueness, breach checking and MFA.

Sources

For a modern password policy, a password manager and MFA rollout in your organization, contact DSET. From our Ankara Hacettepe Teknokent laboratory we provide cybersecurity and KVKK compliance services.