Most people learned the same set of password rules and learned them so thoroughly that they now feel like facts about security rather than advice given at a particular moment. Change it every ninety days. Use a symbol and a number. Answer three questions about your first pet. Several of those rules have since been withdrawn by the same institutions that promoted them, on the basis of evidence about what people actually do when told to follow them, and the withdrawals were considerably quieter than the original instructions.
Forced Expiry Every Ninety Days
Mandatory rotation was the most widely adopted rule and is now the most thoroughly discredited. The reasoning behind it was sound in the abstract: if a password is compromised without anyone noticing, expiring it limits how long the exposure lasts. What the reasoning omitted was the response of the people subject to it, which was entirely predictable in hindsight. Faced with a new password four times a year, users made the smallest possible change to the one they had, and the resulting sequence was trivially guessable by anyone who obtained a single earlier version.
The other cost was that rotation made every password worse at the outset. A person choosing a credential they will keep for years will invest some thought in it; a person choosing one they will discard in ninety days will not, and will write it on something. What the standards now say is to leave a credential alone until something suggests it has leaked, and only then to replace it, which is close to the opposite of what a generation of workplace policies enforced.
The Character Requirements That Produced Predictable Passwords
Composition rules demanded an uppercase letter, a lowercase letter, a digit and a symbol, on the theory that this multiplied the number of possible combinations. Arithmetically that is true. Behaviorally it produced an extremely narrow set of outcomes, because people satisfy such rules in the same handful of ways: capitalize the first letter, put the digit at the end, and use an exclamation mark. Attackers know this, and password cracking tools have encoded those exact transformations for many years.
The replacement is length, which delivers what complexity was supposed to deliver and does it without fighting human nature. A long passphrase made of ordinary words is easier to remember, faster to type, and harder to attack than a short string decorated with symbols. The rule that survives is a minimum length with a check against lists of known compromised passwords, and the rules that have gone are the ones dictating which characters must appear where.
Security Questions About Your First Pet
Knowledge based recovery questions were introduced as a convenience for people who had forgotten a password and have become one of the weaker links in most accounts. The difficulty is that the answers are either publicly discoverable, being the sort of thing people post, or they are shared across dozens of sites, so a breach at one careless service hands over the recovery answers for many others. They are also frequently guessable from a small set of common responses.
Where such questions cannot be avoided, the workable approach is to stop treating them as questions. Generating a random string as the answer and storing it alongside the password converts a weak secondary credential into a second strong one, at no additional cost beyond the storage that is already being used for the password itself. Where a service offers a genuine recovery method instead, such as a code sent to a verified device, that is almost always the better option.
The Rule Against Ever Writing One Down
The instruction never to write a password down made sense when the threat being imagined was a colleague reading a note under a keyboard, and it aged badly once the realistic threat became somebody on another continent working through a list of stolen credentials. What the National Institute of Standards and Technology recommends on passwords moved years ago toward accepting that memory has limits and that a written record kept somewhere sensible is a reasonable defense against reuse, which is the far larger risk. A notebook in a drawer at home is not the weak point in most households, and treating it as one pushed people toward using the same short password everywhere, which is precisely the outcome the rule was meant to prevent.
The related instruction that has aged just as badly is the ban on password managers, which persisted in some workplaces long after the tools became mature. The objection was that concentrating every credential behind one master password creates a single point of failure, which is true and is also the wrong comparison, since the realistic alternative is not perfect memory but the same password on forty sites. Concentration is a risk that can be managed with a strong master credential and a second factor. Reuse is a risk that cannot be managed at all, because it hands an attacker every account the moment any one service is breached.
What Replaced All of It
Three practices now carry most of the weight, and none of them are rules about the shape of a password. The first is uniqueness, meaning a different credential for every account, which is what actually contains the damage when a service is breached. The second is a manager to make uniqueness possible, since the alternative is a system nobody can sustain past a dozen accounts. The third is a second factor on anything that matters, which defeats a stolen password outright.
What the retired rules have in common is that they asked people to compensate, by effort and memory, for a problem better solved by tooling. That is why they failed: not because the reasoning was wrong on paper, but because the behavior they produced was worse than the behavior they replaced. The current advice asks for less discipline and delivers considerably more protection, which is a rare combination and the reason the reversals happened at all.
