# What is Password rotation?

> Changing passwords on a fixed schedule, even when there is no sign that an account was compromised.

Last reviewed: 2026-09-01

## Password rotation

Category: Passwords

Also called: password expiry, forced password change

Canonical page: https://moolkey.com/glossary/password-rotation

Password rotation means changing passwords at fixed intervals, typically every 60 or 90 days. Modern guidance has reversed on this: NIST SP 800-63B now recommends against arbitrary expiry, because forced changes push people toward predictable patterns like Spring2026 followed by Summer2026.

### Why scheduled expiry backfires

A person forced to invent a new password every quarter does not generate a new random one. They increment. The observable result across large organisations is a population of passwords following visible patterns, which is far easier to attack than a stable set of strong unique ones.

### When you should rotate

On evidence, not on a calendar. Change a password immediately if it appeared in a breach, if you reused it somewhere that was breached, if you shared it and the sharing has ended, or if you suspect any compromise of the device you typed it on.

### What people often get wrong

Claim: "Changing my passwords every 90 days makes me safer."

Correction: It usually makes you less safe. NIST reversed this guidance because forced rotation produces predictable sequences. Rotate in response to evidence of exposure instead.

### Sources

- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.