How Often Do I Need to Change My Password?
For decades, the conventional wisdom of “periodically changing” your login password stood firm. Concerns about passwords being stolen or discovered and threat actors gaining access to your valuable information caused this to be true and necessary. However, more recently, the conversation has been expanded and the “rules” have changed.
You may have read information from the National Institute of Standards and Technology (NIST) that says changing passwords is not only no longer necessary, but could be harmful leading to the use of simple or slightly varied passwords. That comes with some caveats about how you are creating your passwords and how you are securing them.
Let’s start by looking at best practice password hygiene.
- Passwords should be at least 16 characters in length. This will not only make them near impossible to crack with a password cracking tool, but will also prevent them from being stored in a browser (which you should never do).
- Passwords should be complex in nature. This means that they should include numbers, lower case letters, upper case letter, and special characters. The easiest way to achieve this is by using a password manager that will generate the passwords for you and store them for future use so you never need to type them.
- Multi Factor Authentication should be used for all systems that you log in to. This means that even if someone did get your password, they would not be able to login to the system without the second factor.
- Password should be used for one and only one application. Reusing passwords increases the possibility of multiple systems being compromised if a single password is stolen.
You should be sure to change your password in the following cases:
- After a breach of your password
- After using a public Wi-Fi system
- After logging into your accounts from someone else’s computer
- If it has been a while since you have logged into an account
