Do this
Regularly change passwords: Frequent password changes were once common advice, but there is no evidence it reduces crime, and it often leads to weaker passwords and reuse across accounts.
Why it’s outdated
Forced changes on a schedule backfire. People make small, predictable edits (Password1 becomes Password2) that attackers guess easily, or reuse passwords to cope. The FTC’s chief technologist made this case in 2016, the UK’s National Cyber Security Centre advises against forced expiry, and NIST’s current guidelines say services must not require periodic changes.
Sources
When to change a password
Change a password right away if a site tells you it was breached, if you used it anywhere else, or if you think someone else knows it.
Common questions
That’s old advice. Frequent password changes often lead to weaker passwords or reuse. A long, unique, randomly generated password stored in a password manager is far safer—and adding multi-factor authentication (MFA) protects you even if a password leaks.
Do this instead
A long, unique password kept in a password manager, plus multi-factor authentication, protects you without scheduled changes.