Almost everything most of us were taught about passwords is now considered actively counterproductive. Complexity rules, forced monthly changes, symbols and numbers in fixed positions — all of it produced worse security while feeling rigorous.
The guidance changed several years ago. A great many password policies have not.
Why forced expiry had to go
The logic seemed sound: if a password is stolen, changing it regularly limits the damage.
What happens in practice is that people cannot memorise a genuinely new strong password every ninety days, so they make a small predictable change instead. Summer2026! becomes Autumn2026!. An attacker who has one knows the next.
Forced expiry also encourages reuse across systems and generates a steady stream of reset requests — which, incidentally, trains staff to expect password reset emails, making phishing easier.
The NCSC now advises against routine expiry. Change passwords when there is reason to believe one has been exposed, not on a timer.
What good looks like now
Length over complexity. Three random words — the NCSC’s recommendation — produces something long, memorable and hard to guess. A short password with a symbol wedged in the middle satisfies a policy and little else.
Uniqueness, which matters more than either. The most common route into a business account is not guessing; it is a password stolen from an unrelated breach and tried everywhere. That only works if the password was reused.
A password manager. This is the change that makes uniqueness realistic. Nobody can remember eighty distinct passwords, so if you want them unique you must stop asking people to remember them. Business password managers also let you share credentials for shared accounts without emailing them around, and remove access instantly when someone leaves.
Check against known breaches. Both Microsoft Entra and most password managers can flag passwords that have appeared in public breach data. That is a far better trigger for a change than the calendar.
Four password questions most people get wrong
The answers have changed in the last few years, which is rather the point.
Passkeys: what they actually are
A passkey replaces the password rather than adding to it.
When you create one, your device generates a pair of cryptographic keys. The public half goes to the website; the private half stays on your device, protected by your face, fingerprint or device PIN. Signing in means your device proving it holds the private key — nothing secret is transmitted.
Two consequences follow, and both are significant.
There is nothing to steal in a breach. A site that is compromised leaks public keys, which are useless on their own.
They cannot be phished. A passkey is bound to the genuine website address. Present it with a convincing lookalike domain and it simply will not authenticate — not because the user spotted anything, but because the cryptography does not match. This is the property that codes from an authenticator app do not have.
Where passkeys are realistic today
Better than they were, and better than most businesses assume. Microsoft 365, Google, and a growing number of business applications support them, and both Windows Hello and Apple’s ecosystem handle the device side.
The sensible approach is not to replace everything at once. Enable passkeys where they are supported, starting with administrators and anyone handling money, and keep strong unique passwords plus MFA everywhere else. Hardware security keys are worth considering for the highest-risk accounts, because they are not tied to a phone.
What to change this quarter
Turn off forced password expiry, unless a specific regulatory obligation requires it — and check whether it genuinely does rather than assuming.
Roll out a password manager, which is the single change that does most for real-world security.
Enable passkeys where they are available, and start with the accounts that would hurt most.
And make sure MFA covers everything, because none of the above helps an account that has neither.
If your password policy still says ninety days, it is worth a short conversation. Changing it is usually a five-minute administrative task and one of the few security improvements staff actively welcome.
