Why did we have to change our passwords every 90 days?

In 1985 the US Defense Department’s password guideline, and a federal standard issued the same year, set the longest a password should last at one year, on the logic that the longer one is used, the likelier it has been exposed, and a stolen one should eventually stop working. The 90-day rule came later. In 2004 the credit-card industry’s security standard told every business that handled card data to “change user passwords at least every 90 days,” and Microsoft’s recommended Windows settings said 90 days too.

People had other ideas. Made to change their password, many chose a small edit to their prior one instead. In 1999 two researchers at University College London, Anne Adams and Angela Sasse, published a study with a pointed title: “Users Are Not the Enemy.” Instead of blaming people, they asked why passwords went wrong. One employee told them, “because I was forced into changing it every month I had to write it down.” Others linked their passwords through a common element and changed one part to satisfy the rules, so tom1 became tom2, then tom3.

The reversal came in two steps. In 2017 NIST, the US standards agency whose password guidance many organizations follow, advised that services “should not” make people change passwords arbitrarily. Microsoft followed in 2019, dropping expiration from its recommended Windows settings and calling it “an ancient and obsolete mitigation of very low value.” NIST’s 2025 edition goes further: services “shall not” make people change passwords on a schedule, and should ask for a new one only when there is evidence the old one has been stolen.