Your Password Policy Is Stuck in the Past
Your password policy might be training people to make weaker passwords.
Think about it: every 90 days, someone on your team sighs, adds a number to the end of their password, and calls it a day. That exclamation point you require? It’s probably in the same spot for everyone. And that short minimum length? It’s practically an invitation to use “Password123.”
Compliance with a complex rule isn’t the same as resistance to guessing. A password can meet every formatting requirement and still be predictable. Worse, these rules create friction—and friction leads to sticky notes under keyboards or reused passwords across accounts.
The good news? There’s a better way. Security standards bodies are shifting their guidance, and it’s time your policy caught up.
- Allow long passwords and passphrases. Length beats complexity every time. “CorrectHorseBatteryStaple” is stronger than “P@ssw0rd!”—and easier to remember.
- Check new passwords against known-compromised lists. If it’s been breached before, block it. Simple.
- Drop routine expiration unless there’s a reason to suspect compromise. Forced rotations don’t add security; they add frustration.
- Provide a password manager and help people get comfortable using it. It’s the single best tool to break the cycle of weak, reused passwords.
- Pair better passwords with multifactor authentication (MFA). It’s the safety net your accounts need.
The help desk is swamped with reset requests, and the security team is enforcing rules that create little value. Meanwhile, managers want fewer compromises and less friction for their teams.
Here’s the shift: stop making employees solve the password problem alone. Make the safer behavior the easier behavior. Long passphrases, password managers, and MFA aren’t just best practices—they’re practical steps to reduce risk without driving your team crazy.
Your password policy can look strict on paper and still fail in practice. But a policy your team can actually follow? That’s real security.
Takeaways
- Complexity rules and forced rotation produce predictable patterns like an added digit or a trailing exclamation mark.
- Allow long passphrases, check new passwords against known-compromised lists, and drop routine expiration without evidence of compromise.
- Provide a password manager and pair passwords with MFA so the safe behaviour is the easy one.
Questions
- Should passwords expire every 90 days?
- Not routinely. Forced rotation adds frustration and predictable changes rather than security; change passwords when there's reason to suspect compromise.
- Is a long passphrase better than a complex password?
- Generally yes. Length beats complexity, and a passphrase is easier to remember than a short password full of substitutions.
- What should a modern password policy include?
- Support for long passwords and passphrases, checks against known-compromised passwords, no routine expiry, a password manager for everyone, and MFA.