SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-nist-no-forced-change

Does NIST say companies should force staff to change passwords on a schedule?

No. NIST says not to require periodic changes.

Start playing free

  1. No, do not force periodic changes ✔
  2. Yes, every 30 days
  3. Yes, every 90 days

Why: Forced changes lead to small tweaks like Summer1 to Fall1. NIST says verifiers should not require periodic changes. Of course, change a password right away if you think it leaked.

Huh, didn't know that: NIST also says to compare new passwords against a blocklist of commonly used or compromised ones.

The dad joke
I changed all my passwords to 'incorrect.' That way I always know what I did wrong.
Like this card?
Play the game

References

Answer: No, do not force periodic changes. Forced changes lead to small tweaks like Summer1 to Fall1. NIST says verifiers should not require periodic changes. Of course, change a password right away if you think it leaked.

  1. NIST SP 800-63B Digital Identity Guidelines pages.nist.gov/800-63-4/sp800-63b.html
    SHALL NOT require subscribers to change passwords periodically
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhat does current NIST guidance say about forcing symbols and capital letters in passwords?Security & PrivacyNIST says a password used as the only login factor should be at least how long?Security & PrivacyShould a login page let you paste a password, according to NIST?

That's stuff everyone should know.