The old advice, and why it changed
For many years the standard advice was to change every password every 60 or 90 days. Workplaces enforced it, and many people still believe it is the safest habit. Current guidance from security professionals has generally moved away from it.
The reason is how people behave. When forced to change often, most people pick a small variation of the old one, such as adding a number or changing a character. Attackers know this pattern. Frequent changes also lead to more written-down, forgotten or weak passwords. If a password is long, unique and has not been exposed, changing it on a schedule adds little protection and can reduce it.
This does not mean never changing a password. It means changing for a reason.
When a change really helps
A password should be changed promptly when there is evidence or a reasonable suspicion that it is no longer secret.
After a breach. If a service you use reports a breach, or a checking service shows your details exposed, change that password. The steps for checking are covered in breach exposure checks.
If you reused it. If the password is used on more than one site and any one of them is affected, change all of them, and give each a different one. The reason is laid out in password reuse.
After a sign of takeover. Unexpected password reset emails, unfamiliar sign-in alerts, or messages sent from your account that you did not write all call for action. See account takeover signs, and follow the steps for hacked account response.
After typing it somewhere you should not have. If you entered it on a page you now suspect was fake, change it at once on the real site, and anywhere else you used it.
After a lost or stolen device. If a device had saved logins, change important passwords from a safe device and sign out remotely. Finding and locking a phone is covered in lost phone tracking.
After sharing it. If you gave a login to a coworker, a friend or a relative who no longer needs it, change it. Safer ways to share are described in shared account access.
When someone may have seen it. A password written on a sticky note that others could read, or typed while someone was watching, is worth replacing.
When it is weak. If it is short, a common word or based on personal details, replace it with something stronger, even without any incident.
When a manager flags it. Many password managers warn about reused, weak or exposed passwords. Those warnings are a good prompt.
When changing adds little
- A long, random, unique password that has not been exposed and is protected by a second step.
- A passkey, which has no password to rotate.
- Accounts you can close, where deleting the account is often better than maintaining it.
- Purely calendar-driven changes with no other trigger.
If your employer or a service demands periodic changes, follow the rule, but make each new password a fresh, unrelated one rather than a variation.
How to change one well
- Go to the real site directly by typing the address or using your bookmark, not a link in a message. This avoids fake pages.
- Choose a new password that is long and different. Let a password manager generate it, or use a passphrase for the few you must remember. Do not recycle an old one with a number added.
- Turn on or review the second step while you are in the security settings.
- Sign out other sessions if the service offers it, so anyone already logged in is removed.
- Check recovery details, including the recovery email address, phone number and any security questions.
- Review connected apps and forwarding rules, particularly in email. Attackers sometimes add a forwarding rule that continues to work after a password change. Connected app access is worth checking on social accounts too.
- Update your manager so it holds the new password.
Deciding what to change first
If a breach hits and you have many accounts, go in order of damage potential:
- Email accounts, because they can reset others.
- Banking, payment and shopping accounts.
- Cloud storage and anything holding personal documents.
- Social media and messaging.
- Everything else.
You do not need to do everything at once. A steady pace is better than burning out and giving up.
If the change is part of a bigger clean-up
When an account has been compromised, a password change alone may not be enough. Malware on a device, a forwarding rule, or an unrecognized connected app can let the attacker back in. The checklist in post-breach cleanup covers the wider steps. Money-related accounts may need a call to the provider, along with reviewing statements and perhaps placing a credit freeze if identity details were involved.
A reasonable routine
Rather than a fixed schedule, many people find a light yearly check useful: scan the manager’s security report, update anything weak or reused, remove accounts you no longer use, and confirm recovery details are current. Between those reviews, change passwords when one of the triggers above occurs.
The aim is simple. Keep passwords strong and unique from the start, and change them when there is a reason, not just because a date has passed.