How often should you change passwords? What NIST SP 800-63B actually says

How often should you change passwords, according to NIST?

According to NIST SP 800-63B, you should not change passwords on a fixed schedule; change one only when there is evidence or reasonable suspicion that it has been compromised.

NIST SP 800-63B is the US National Institute of Standards and Technology's guideline on digital identity and authentication. Federal agencies follow it, and many private companies, auditors and security frameworks borrow its password rules.

The guideline tells the systems that check passwords (NIST calls them verifiers) not to make users change passwords periodically. It does require a change when a password is known or suspected to be compromised. The latest revision words the first point as a "shall not", the strongest form NIST uses.

So the honest answer to "how often" is: every time something goes wrong, and otherwise never just because a date has passed.

Why did NIST stop recommending regular password changes?

NIST dropped forced expiry because it pushes people toward weaker, more predictable passwords without cutting off an attacker in time.

When people must change a password every few months, they rarely invent a new strong one. They make a small, predictable edit: Summer2025! becomes Autumn2025!, or a trailing number goes up by one. Anyone holding the old password can guess the new one in a few tries.

Rotation also arrives too late. A stolen password is usually used soon after it is stolen, not months later when the next scheduled change comes round.

Constant changes also push people to write passwords down, reuse them across sites, or call the help desk for resets, which opens the door to social engineering. The better trade is one long, unique password, kept until there is a reason to change it, with the effort moved to spotting compromise.

When should you change a password?

Change a password immediately whenever there is a concrete reason to believe someone else could know it.

1. The service announces a data breach, or a monitoring service such as Have I Been Pwned lists your account or password.
2. You used the same password on another site that was breached.
3. You typed it into a phishing page or a login prompt you are not sure about.
4. A device that stored or typed the password was lost, stolen or infected with malware.
5. Someone who knew a shared password leaves the team or no longer needs access.
6. The password was sent over an insecure channel: chat, email, a sticky note or a shared spreadsheet.
7. The account shows sign-ins, reset emails or two-factor prompts you did not trigger.
8. The password is short, weak or on a common-password list, even if no breach is known.

For the full sequence after a breach notice, follow the data breach password response checklist. When someone leaves, the employee offboarding password checklist covers which shared logins to rotate and in what order.

Why does NIST favour password length over complexity?

NIST favours length because every extra character multiplies the guesses an attacker needs, while complexity rules mostly produce predictable substitutions.

Rules like "one uppercase letter, one number, one symbol" tend to produce Password1!, which passes every rule and sits near the top of every cracking list. NIST SP 800-63B tells verifiers not to impose composition rules like these at all.

Instead, the guideline focuses on length. The current revision sets a minimum of 15 characters when a password is the only thing protecting an account, and 8 characters when it is used together with another factor such as an authenticator app. Systems should accept at least 64 characters, allow spaces and any printable character, and let people paste passwords so password managers work.

NIST also says not to offer password hints or knowledge-based questions such as the name of your first pet. A passphrase of four or five unrelated words is easy to type and hard to guess; a random 20-character password from a password manager is stronger still, because nobody has to remember it.

How do old password rules compare with NIST guidance?

Most older password policies conflict with NIST SP 800-63B on almost every point.

What is password breach screening?

Password breach screening is checking a new or existing password against lists of passwords already exposed in breaches, plus common and predictable choices, and rejecting any match.

NIST SP 800-63B requires verifiers to compare new passwords with a blocklist. That list should include passwords from previous breaches, dictionary words, repeated or sequential characters such as aaaaaa or 1234abcd, and context-specific words like the service name or the user's own username.

Screening replaces the calendar as the trigger for change. Instead of rotating everyone every quarter, you change the passwords that are actually exposed, and you change them straight away.

Have I Been Pwned runs a free Pwned Passwords service built on k-anonymity: only the first five characters of a SHA-1 hash of the password are sent, so the service never sees the password itself. Several password managers and sign-in systems use it for exactly this check.

How do you update a team password policy to match NIST?

Replace the rotation schedule with event-based changes, a length minimum, breach screening and multi-factor authentication, then write the policy down.

1. Turn off forced expiry in your identity provider, directory and any app that lets you disable it.
2. Set a minimum length of 15 characters for passwords used without multi-factor authentication, and remove composition rules.
3. Turn on multi-factor authentication for email, admin consoles, finance tools and every shared account.
4. Screen passwords against known-breached lists, in your identity provider or through your password manager.
5. List the events that trigger an immediate change: breach notice, phishing, lost device, leaver, insecure sharing.
6. Give everyone a password manager so long, unique passwords cost nothing to keep.
7. Review shared logins whenever people change roles, and keep a record of who can open what.

If a contract, insurer or compliance framework still demands periodic changes, follow it for the systems in scope and cite NIST SP 800-63B when you ask for the requirement to be updated. A ready-to-edit version of this policy is in the password policy template for small businesses.

Where does a password manager fit in a no-rotation policy?

A password manager makes the NIST approach practical: it creates long unique passwords, flags breached ones, and shows exactly which logins to change when something happens.

BobWork Vault is a free password manager for teams that fits this model. It offers a 20-character generated password on sign-up forms, and its breach alerts check saved passwords against Have I Been Pwned using k-anonymity, so only the first five characters of a SHA-1 hash leave the browser.

When someone leaves, BobWork Vault's guided offboarding removes their access, re-keys the shared items they could open and builds a checklist of passwords to change on each site. That is event-based rotation in practice. BobWork Vault does not send password-expiry reminders, which suits a policy that no longer rotates on a schedule.

It can also store authenticator (TOTP) secrets and fill the 6-digit code after the password, which helps when multi-factor authentication protects shared accounts. Everything is encrypted in the browser before it reaches the server; the BobWork Vault security page explains the zero-knowledge design.

To put this into practice, create a free BobWork Vault account and import your existing passwords from a CSV export.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• Sample password policy for small business: a short, modern template you can copy today
• What to do after a data breach: a 24-hour password checklist for small companies
• How to get employees using unique passwords (and stop password reuse)
• Employee offboarding checklist: what to revoke, rotate and hand over

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers