Itwerx is a service-disabled veteran-owned managed IT and cybersecurity provider serving Seattle-area businesses, founded in 2005, and one of the most persistent pieces of outdated advice we still hear from new clients is that passwords need to be changed on a fixed schedule regardless of whether anything is wrong.
If you have a good password in place, you do not need to change it on a schedule, ever, unless you have reason to suspect it has been exposed. This has been considered best practice for over a decade. If your IT department is still forcing scheduled internal password changes, that policy is well behind current guidance.
Why the old advice was wrong
Forced rotation was built on an assumption that a password might be quietly compromised at any time without anyone knowing, so cycling it regularly limited the exposure window. In practice, forced rotation mostly produces predictable, weaker passwords, since users under a mandatory change schedule tend to make small, guessable variations on their previous password rather than choosing something genuinely new and strong. The rule ended up encouraging the exact behavior it was meant to prevent.
What current guidance actually says
The current school of thought is short:
- Longer is better, even at the cost of some complexity.
- Keep every password unique, and use a password manager to make that practical.
- Add two-factor authentication wherever it is available.
That is essentially the whole of it, for an end user. There is more to say on the technical and server side of password policy, but for the person actually logging in every day, those three points are what current guidance amounts to.
If a password is genuinely strong, unique, and backed by a second factor, changing it on a calendar rather than for a reason does not make it any safer, and it very often makes it weaker.
Itwerx Corp is a service-disabled veteran-owned small business providing IT services across Seattle, Bellevue, Everett and Snohomish County. This is the kind of thing our cybersecurity work deals with – talk to us about yours.
