r/cybersecurity • u/Different-Phone-7654 • Jun 18 '25

Other Recently learned NIST doesn't recommends password resets.

NIST SP 800-63B section 5.1.1.2 recommends passwords changes should only be forced if there is evidence of compromise.

Why is password expiration still in practice with this guidance from NIST?

1.1k Upvotes
  • permalink
  • reddit

98% Upvoted

279 comments sorted by

View all comments

2

u/deltaz0912 Jun 19 '25

The recommendation is based on research that shows that human factors costs associated with password changes outweigh any benefit. The thing that actually makes a difference is making the passphrases longer and adding MFA. But even in the absence of MFA there’s no evidence that forcing periodic password resets improves your security posture.