A Practical Guide to Password and Credential Hygiene

Much of the password advice still enforced by corporate IT policy and repeated in general-audience articles is out of date. This guide walks through what current guidance — anchored in NIST’s Digital Identity Guidelines — actually recommends, and why it changed.

The three pillars of current guidance

1. Stop rotating on a schedule

Mandatory 90-day password changes, once universal, are now explicitly discouraged by NIST for most use cases. The research showing why is straightforward: forced rotation pushes people toward small, predictable modifications of an existing password rather than genuinely new strong ones. Read the full breakdown: How often should you actually rotate your passwords?

2. Use a password manager, not memorized reuse

Even a strong, well-constructed password becomes a liability once it’s reused across accounts — one breach exposes every account sharing it. A password manager removes the memory constraint that drives reuse, letting you use a unique password everywhere. See: Is a password manager safer than reusing strong passwords?

3. Prioritize length over forced complexity

For any password you do need to remember, a long passphrase of random, unrelated words provides more resistance to brute-force attacks than a short password stuffed with symbols and numbers — while being easier to recall and type correctly. See: What makes a passphrase stronger than a complex password?

Putting it together: a practical policy

For an individual or small team, a reasonable current-guidance policy looks like:

1. Use a reputable password manager for every account that supports it.
2. Generate long, random, unique passwords via the manager rather than composing them manually.
3. Protect the password manager itself with a strong passphrase and multi-factor authentication.
4. Enable MFA everywhere it’s offered, especially email, financial accounts, and the password manager itself.
5. Change a password immediately upon any breach notification or suspicious activity — not on a calendar.
6. Screen any manually chosen password against known-breached password lists (most managers and many services do this automatically now).

Why this still meets — and often exceeds — compliance requirements

Some organizations remain bound by frameworks or contracts that specify rotation schedules regardless of NIST’s updated recommendation. Where that’s the case, follow your actual compliance requirement — but recognize that rotation-heavy legacy policy is not, on its own, evidence of stronger security, and pushing for a policy update citing current NIST guidance is a reasonable position for a security team to take.

Bottom line

The highest-leverage changes are usually not the ones with the most historical inertia. Dropping scheduled rotation, adopting a password manager, and favoring passphrase length over symbol complexity are the three changes most likely to measurably improve real-world account security today.