Changing your password every 90 days does not make you safer. It might actually be making you less secure.

That is not a hot take. That is the current position of the National Institute of Standards and Technology, the federal body that literally writes the rulebook on digital security. And yet millions of Americans are still following outdated advice, clicking “remind me later” on account security prompts, and reusing the same tired passwords across a dozen platforms while believing they are covered.

Meet Carla. She is 38, works in HR at a mid-size company in Phoenix, and considers herself reasonably tech-savvy. She uses a different password for her bank than she does for Facebook. She changes her work password every quarter because IT makes her. She has never been hacked, as far as she knows. What Carla does not know is that her email address appeared in three separate data breach databases in 2023, her original LinkedIn password from 2019 is still circulating on dark web forums, and the password she uses for her bank is a slight variation of the one that leaked. Carla is one credential-stuffing bot away from a very bad week.

Think of it this way: your password is not a lock you set once. It is more like a key that gets duplicated every time a company that holds it gets burglarized. You never see the break-in. You never get a copy of the new key. But someone else does.

Why the Advice You Grew Up With Is Now the Problem

For decades, security departments told employees to rotate passwords frequently and make them complex. Uppercase letters, numbers, symbols. The logic made sense in isolation. The problem is what humans actually do when forced to follow that logic: they make passwords that are barely different from the last one. “Password1!” becomes “Password2!” becomes “Password3!” Security researchers at Carleton University published findings in 2016 confirming that predictable transformation patterns in forced password resets make accounts nearly as vulnerable as if the password had never changed.

NIST officially reversed its guidance in 2017. Frequent rotation is out. Length and uniqueness are in. The security industry largely agrees. And yet corporate IT policies, legacy software, and sheer institutional inertia mean that millions of people are still following rules that the experts abandoned years ago.

Ask yourself why the companies that built those rules have been slow to update them. Compliance theater is easier to audit than actual security. A checkbox that says “password changed every 90 days” is measurable. A checkbox that says “employees genuinely understand phishing vectors” is not.

Did You Know: A 2023 Verizon Data Breach Investigations Report found that 74% of all breaches involve the human element, including stolen credentials. The technology is rarely the weakest link. The habits are.

The Real Problem: Your Old Passwords Are Already Out There

Here is the part that should make you genuinely uncomfortable. The password you used for a retail site in 2018 that got breached? It is probably still in active rotation on hacker forums. Breach data does not expire. It gets aggregated, sold, and re-sold. Attackers combine old breach files into massive datasets called “combo lists” and run them against current login pages automatically. This technique is called credential stuffing, and it works at scale precisely because people reuse passwords.

How many accounts are you using the same password on right now, honestly?

According to a 2023 SpyCloud report, 87% of successful account takeovers involved passwords that had already appeared in a previous breach. The attacker did not need to be clever. They just needed to be patient and automated.

The breach you are most exposed to is probably not the one that happened yesterday. It is the one from five years ago that you forgot about, involving a service you stopped using, with an email and password combination you are still using somewhere that actually matters.

Warning: Free breach-notification services like HaveIBeenPwned.com only surface breaches that have been publicly disclosed. Private breach data, sold quietly on closed forums, never makes it into those databases. Your exposure may be larger than any free tool can show you.

Passphrase vs. Complexity: What the Research Actually Says

I dug into the actual research so you do not have to. Here is what I found.

A 2023 study by Georgia Tech researchers found that longer passwords, even those made of random words, take exponentially longer to crack than shorter complex passwords. A 12-character password with uppercase, numbers, and symbols can be brute-forced in a matter of hours with modern GPU hardware. A 20-character passphrase made of four random words takes, by current estimates, longer than the age of the universe to crack by brute force.

The formula that security professionals actually use looks like this: three or four unrelated words plus a number. “Cactus-Stapler-Riverboat-88” is both memorable and functionally uncrackable by brute force. It is longer than most complex passwords. It is far easier to remember. And because it does not follow a predictable substitution pattern, it resists the dictionary-attack variations that fool short complex passwords.

Complexity theater, the idea that “P@ssw0rd!” is secure because it has symbols, is one of the most persistent myths in consumer security. The length is what buys you actual safety. Every character you add multiplies the difficulty of a brute-force attack exponentially.

Pro Tip: Build your passphrases with a personal formula you can repeat: pick three nouns that have nothing to do with each other, add a two-digit number you will remember, and separate them with hyphens or spaces. “Marble-Penguin-Stoplight-44” is 26 characters, requires zero memorization tricks, and would take modern hardware billions of years to crack by brute force.

Why Breach Transparency Works Against You

Here is what this actually means for you. When a major company gets breached, there is a gap. A gap between when the breach happens and when you hear about it. In the case of the 2021 LinkedIn breach, stolen data was circulating for months before it became public knowledge. The 2022 LastPass breach was disclosed in stages over several months, with the company revising the severity of its disclosures upward each time as more details emerged. The full scope of what was stolen, including encrypted password vaults, was not disclosed until December 2022, months after the initial incident.

Here is the real story behind the headlines: breach transparency from companies often serves the company’s PR timeline far more than your security. By the time you are told to change your password, whoever bought your data has already had weeks or months to use it.

Your Next 3 Steps

You do not need to overhaul everything today. You need to take three specific actions, in this order, starting now.

Step 1: Go to HaveIBeenPwned.com right now and run every email address you use.

This takes four minutes. Enter your primary email, your work email, and any old addresses you still have access to. Write down every breach result, including old ones. Do not dismiss anything as “too old to matter.” Breach data from 2017 is still being used in credential-stuffing attacks today. If an email appears in any breach tied to a password you are still using anywhere, that password is compromised. Treat it that way.

Step 2: Download Bitwarden (free) or open your existing password manager and flag every reused or short password.

Bitwarden is free, open-source, and audited by independent security researchers. If you do not have a password manager, this is the week you get one. Once it is installed, import or manually add your accounts and run the built-in password health report. Flag every account where the same password appears more than once and every password under 14 characters. You are building your repair list.

Step 3: Starting with your email account and your bank, replace every flagged password with a passphrase using the formula from this article.

Use the structure: three unrelated nouns, one two-digit number, hyphens between them. “Gravel-Lantern-Tortoise-63.” Do your email account first, because email is the master key to every other account reset. Then your bank. Then work down your flagged list, five accounts today and five tomorrow. Do not wait until you have time to do all of them at once. You will not find that time. Do five now and the momentum carries the rest.

Your passwords are not going to update themselves. And the bots running credential-stuffing attacks right now are not waiting for you to feel ready.

If this kind of gap between what you are told and what is actually true frustrates you, you are not alone. We see the same pattern in financial advice, job market coverage, and housing decisions, including the refinancing window most homeowners miss entirely, where the official guidance and the actual opportunity are rarely the same thing. And just like with passwords, the cost of acting on outdated information is paid by you, not by whoever gave you the advice.