Password policies that people actually follow
What current guidance says about passwords, why forced complexity and expiry made things worse, and the policy a small business can enforce without a revolt.
The short answer
For years password policies demanded uppercase, digits, symbols and a change every ninety days, and produced exactly what you would expect: a capital letter at the start, a digit and an exclamation mark at the end, incremented each quarter, and written on a note when it became unmanageable. Current guidance from the UK’s National Cyber Security Centre and the US standards body NIST has moved away from forced complexity and routine expiry, because both made passwords weaker in practice. What works is length, uniqueness and tooling: a password manager for everyone that generates and stores a unique password for every account, long passphrases for the few passwords people must type, a second factor on every account that matters, a check against known-breached passwords, and a change only when there is reason to think a password was exposed. The policy fits on a page, and it is followed because the manager makes the right thing the easy thing.
Old policy, new policy
| Old rule | What it produced | Current guidance |
|---|---|---|
| Uppercase, digit, symbol required | Password1! and variations | Length matters more; allow any characters; no composition rules |
| Change every ninety days | Password2!, Password3!, notes on monitors | Change only on suspicion of compromise |
| Minimum eight characters | Eight-character passwords, cracked quickly | Longer minimums; passphrases; managers generate long ones |
| No password manager, or discouraged | Reuse across every service | Manager provided and required |
| Security questions | Answers findable on social media | Remove; use second factors and recovery codes |
| Account lockout after three tries | Denial of service against your own staff | Rate limiting and slowing, with monitoring |
| Nothing about breached passwords | The most common passwords used everywhere | Check new passwords against breach lists and reject matches |
The one-page policy
- Everyone uses the business password manager, provided and set up by the business.
- Every account gets a unique generated password from the manager; no reuse anywhere.
- The few passwords people type, the manager’s master password and the device login, are long passphrases.
- Second factor is on for email, the manager, the domain and hosting accounts, finance, and every system on the listed set.
- Shared logins live in the manager, shared to named people, never in documents or chats.
- Passwords change when a service reports a breach, after a phishing incident, and when someone with access leaves.
- New passwords are checked against breach lists where the system supports it.
- Report suspected exposure immediately, without blame.
Enforcement that works
Provide the manager and set it up; do not just recommend it. Turn on second factors centrally where the platform allows. Use single sign-on for the systems that support it, so there are fewer passwords at all. Run the breach check at password creation. And when someone reports a suspected exposure, thank them and rotate, so the next report comes just as fast.
What this means for you
Replace complexity rules and routine expiry with a password manager for everyone, unique generated passwords, long passphrases for the few that must be typed, second factors on the accounts that matter, breach checks, and changes only on suspicion of compromise. Put it on one page, provide the tooling, and the policy is followed because following it is easier than not.
Frequently asked questions
Should we still make people change passwords every ninety days?
No. Guidance from the UK's National Cyber Security Centre and the US standards body NIST moved away from routine expiry years ago, because it leads to predictable variations and reuse. Change a password when there is reason to think it was exposed: a breach at a service, a phishing incident, a departure with shared access. Otherwise a long, unique password kept in a manager stays.
What makes a password strong now?
Length and uniqueness far more than symbols. A passphrase of several unrelated words is long, memorable for the one or two passwords people must type, and hard to guess. Everything else is generated and stored by a password manager, so uniqueness is automatic. A check against lists of known-breached passwords stops the ones attackers try first.
How do we get staff to use a password manager?
Provide one, pay for it, set it up on their devices, and show them in ten minutes how it fills logins. Adoption follows convenience: once the manager is filling passwords, nobody wants to go back. Make it the way shared business logins are handled too, so there is no spreadsheet of passwords anywhere, and the manager becomes the obvious place for everything.
Sources
- NCSC (UK): Password policy: updating your approach (accessed 2026-09-12)
- NIST Special Publication 800-63B revision 4: Digital Identity Guidelines, Authentication and Authenticator Management (accessed 2026-09-14)