How Often Should You Change Your Passwords in 2026?

The 90-day rule is officially dead

Nobody credible recommends scheduled password changes anymore. NIST, the US agency that writes the password rulebook, says systems shall not require scheduled changes. Microsoft calls forced expiration "an ancient and obsolete mitigation." CISA agrees. One of those rare moments where the experts and common sense are on the same side.

My take? The 90-day rule was written for a world where attackers guessed passwords one by one. That world is gone.

One exception: if your employer's IT policy forces 90-day rotation, follow it at work. Everything below is for your own accounts.

Why changing on a schedule backfires

I used to be a model citizen about this. Every January I sat down and changed all my important passwords. And every January I did the same lazy thing everyone does: took the old password and tweaked it. Winter2025! became Spring2025!. One extra number. Done. Back to Netflix.

Forced rotation reliably makes people pick weaker passwords, not stronger ones. If an attacker learns your old password, the new one is usually one obvious tweak away. Humans rotate the season, the year, the exclamation mark, and cracking tools know it.

And here is the kicker: modern attacks steal passwords in bulk breaches, not by patiently guessing them. Changing a password that nobody has stolen fixes nothing. The real leverage is in the password itself: longer and random beats short and rotated, as we showed in our passphrase vs password comparison.

Short on time? This video covers strong passwords, password managers, and 2FA in a few minutes.

The 5 times you should change immediately

Rotation is dead, but "never change your password" is also wrong. Change on events, not calendars. These are the only triggers that matter:

1. A breach notification. The service emails you, or you read that it was hacked. Change that password first, then any other site where you reused it.

2. A login you do not recognize. "New sign-in from another country" is not a suggestion. Change the password and sign out other sessions.

3. You shared it with someone. Gave your streaming login to an ex? The moment access is no longer yours alone, it is compromised.

4. It appeared in a breach. Search your email at haveibeenpwned.com, which checks real leaked databases. Anything flagged gets a new password today.

5. It was weak to begin with. Short, dictionary-based, or recycled across five sites. If it would fall to a cracking tool in hours, it needs to go now, whatever the schedule says.

Do this instead: the 20-minute password audit

Here is what actually protects you. I did this exact audit last month: twenty-three minutes, and I found two reused passwords I had completely forgotten about.

Step 1: list your most important accounts. The ones that would hurt the most: email, bank, phone carrier, cloud storage, social media. The top 10 to 15 is plenty. Your forum account from 2019 can wait.

Step 2: check every email against known breaches. Run each address through haveibeenpwned.com. Any account tied to a breached email gets a new password today. No exceptions.

Step 3: give each account its own fresh password. This is the real fix. Open our password generator, set it to 16+ characters, and make a unique one per account. Reuse is the enemy, not age. A password used nowhere else can sit unchanged for years without real risk.

Step 4: turn on two-factor authentication. Start with your email, because email resets everything else. 2FA blocks the vast majority of account takeovers even when a password leaks.

Step 5: delete the rotation reminders. Cancel any recurring "change your password" reminders. From now on you change passwords when something happens, not when the calendar says so.

The honest verdict for 2026

So how often should you change your passwords in 2026? When you have a reason. For most people with strong, unique passwords and 2FA, that means rarely. Maybe once or twice a year something triggers it: a breach email, a weird login alert, a shared password you want back.

Rotation felt productive, but feeling productive is not the same as being secure. Length, uniqueness, and two-factor authentication stop real attacks. Spend your energy there.

Run the audit once this weekend. Then stop thinking about passwords on a schedule, and start sleeping better. Everything you need is in our free tools: the generator makes the passwords, and the strong password guide covers the rest.

Frequently asked questions

Is changing passwords every 90 days still recommended?

No. NIST, Microsoft, and CISA all advise against scheduled rotation. It pushes people toward predictable tweaks like Winter2026! to Spring2026!. Change on events, not on calendars.

When should I definitely change a password?

Change it immediately if you get a breach notification, see a login you do not recognize, shared the password with someone, or learn the password appeared in a breach. Also change any password you reuse across accounts.

What matters more than how often I change passwords?

Three things: length (16+ characters), uniqueness (a different password on every site), and two-factor authentication on important accounts. Together they stop far more attacks than rotation ever did.

Does my work IT policy of 90-day changes still apply?

Yes. Compliance beats being right at work. The advice in this guide is for your personal accounts, where the choice is yours.