Password advice

Do I need to change my password often?

The advice on this has changed, and it is worth knowing why, because the old rule is still printed on a lot of corporate intranets.

For years the standard recommendation was to change every password every 60 or 90 days. The reasoning was that if a password leaked without anyone noticing, rotation would eventually cut the attacker off. In practice the rule backfired. When people are forced to change a password on a schedule, they do not invent a fresh strong one each time. They take what they had and increment it: Spring2025! becomes Summer2025! becomes Autumn2025!. Researchers found these transformations were predictable enough that knowing one old password made guessing the current one straightforward. Rotation also pushed people towards shorter, simpler passwords, because a password you have to retype and rememorise four times a year cannot be complicated.

Current guidance reflects that. NIST Special Publication 800-63B, revision 4, published in 2025, states that verifiers shall not require users to change passwords on a periodic basis, and shall force a change only when there is evidence that the password or the account has been compromised. The UK National Cyber Security Centre reached the same conclusion several years earlier. The same revision also drops mandatory composition rules, the requirement that a password contain a capital, a digit and a symbol, for the same reason: those rules push people towards predictable shapes rather than genuine randomness.

So when should you change a password?

When there is an actual reason. These are the reasons:

• The service told you it was breached, or a breach checker flags your address on that site.
• You used that password somewhere else and one of those places was breached.
• You typed it on a device you do not control, such as a shared or public computer, or a machine you suspect has malware.
• You sent it to someone, or over a channel you would not want read: email, chat, a screenshot.
• Someone who had legitimate access no longer should, such as a former partner, flatmate or colleague.
• You see anything odd on the account: a login from an unfamiliar location, a security alert you did not trigger, a setting you did not change.
• The password is old and weak, or you know you reused it. Change it once, to something long and unique, and then leave it alone.

Outside of those cases, a long unique password stored in a manager can stay in place indefinitely. The energy you would have spent rotating is far better spent making sure no two accounts share a password, and turning on two factor authentication where it exists.

At what point does a password become secure?

A password is secure when guessing it is not worth an attacker's time, and that comes down to two properties: it is long, and it was chosen by something that is not a person.

The practical rules:

• Use at least 16 random characters for anything a password manager stores for you. Twenty to twenty four for email, banking, your domain registrar and anything else that can reset other accounts.
• Let a generator choose it. Randomness is the property that makes the length count. A 16 character password you invented is worth a fraction of a 16 character password a machine produced.
• Never use the same password twice. This matters more than any property of the password itself.
• Mix character types if the site allows it, but do not trade length for it. Four extra characters beat adding symbols.
• Turn on two factor authentication wherever it is offered. A password defends against guessing; nothing else about it defends against phishing or malware.
• Use a passphrase for the few secrets you must memorise. Six random words is 66 bits, easy to type and easy to hold in your head. See passphrases vs random passwords.
• Avoid anything drawn from your life. Names, dates, teams, pets and employers are the first things tried, and they are all public.

The default settings on Createpass.net already meet these recommendations: 16 characters drawn from the full keyboard, which is about 103 bits of entropy. You can raise the length for accounts that deserve more. Our page on password strength explains where that number comes from and what it buys you.

What actually causes account takeovers

It is worth knowing what you are defending against, because the threats are not evenly distributed:

• Credential stuffing. By far the most common. Leaked email and password pairs from one breach are replayed at scale against every other service. Unique passwords stop it completely.
• Phishing. You hand the password over yourself, on a page that looks right. Strength is irrelevant here. A password manager that refuses to autofill on the wrong domain, and a hardware security key, are the defences that work.
• Malware and infostealers. The password is read off your machine. Keeping the operating system and browser updated, and locking the vault when idle, are what help.
• Password guessing. Real, but the least common of the four, and the only one a strong password fixes on its own.

A generator solves one of these four completely and helps with a second. That is a good return for one click, but it is not the whole job.