Why does 90-day rotation with complexity rules make passwords easier to guess, not harder?

## The rule is a recipe, and people follow recipes A password policy that requires an uppercase letter, a lowercase letter, a digit and a symbol is usually described as making passwords stronger. Arithmetically it does the opposite of what it claims. It does not add entropy to a human's choice; it *removes* the choices that fail the rule, and then human convergence removes almost everything else. What survives is a small set of shapes that satisfy every clause with minimum effort: a capitalised word, a two- or four-digit year, one trailing punctuation mark. Add a 90-day expiry and the effect compounds. Now the user must perform that invention four times a year, always under time pressure, always at a prompt they did not plan for. The two overwhelmingly common strategies are: - **The calendar template.** `Spring2026!`, `Summer2026!`, `Autumn2026!` — self-refreshing, always compliant, always memorable, and predictable to anyone who owns a calendar. - **The increment.** `Passw0rd7!` becomes `Passw0rd8!`. Formally a new password; in guessing terms, a one-character neighbour of the old one. Both are gifts to a spraying operator, whose entire attack is a short candidate list applied at breadth. The policy did not just fail to stop the attack — it *manufactured the candidates*. ## What rotation was originally for, and why the reasoning expired Periodic expiry came from an era of offline guessing against stolen hash files: if recovering a password took months, changing it every few months meant the recovered value was stale by the time it worked. Two things ended that reasoning. Guessing hardware collapsed the recovery time, and modern credential theft is not slow — a replayed or captured credential is used in hours, not months. A 90-day window bounds nothing that an attacker in your estate today cares about. ## What the published guidance actually says NIST SP 800-63B is the specification most often cited here, and it is worth being precise about its position: - Verifiers **shall not** impose composition rules on memorised secrets. - Verifiers **shall not** require arbitrary periodic change; a change is required **on evidence of compromise**. - Verifiers **shall** compare a candidate secret against a list of values known to be commonly used, expected or compromised, and reject a match. - Minimum length is a real requirement, and long passphrases must be accepted rather than truncated. Read as a set, that is a coherent repricing of the whole problem. Screening removes the strings that make stuffing and spraying pay. Length raises the cost of guessing generally. Compromise-triggered change replaces a calendar with a trigger that has actual information behind it. Composition rules and expiry are dropped because they push humans toward templates and buy nothing in return. ## The reviewer's version of this answer The chair you are usually sitting in is the reviewer told: *"we enforce complexity, 90-day rotation and five-attempt lockout, so guessing is handled."* All three claims can be true and the estate still be sprayable, because each control is aimed at a different attack from the one being run: | Stated control | What it actually bounds | Effect on a spray | |---|---|---| | Complexity rules | the shape of the string | narrows the candidate list in the attacker's favour | | 90-day rotation | how old a password may be | refreshes the template on a schedule | | Five-attempt lockout | guesses against one account | untouched; a spray sends one | The replacement set is short and unglamorous: a breached-password screening check at set time, a genuine minimum length with passphrases allowed, a ban on the organisation's own strings, and a forced change only when there is reason to think a specific credential is compromised. ## The nuance worth keeping None of this means passwords should never change. It means the trigger should carry information. A credential that appears in a new corpus, an account that shows a sign-in the owner disowns, a shared secret after a team member leaves — all are real triggers. A quarter boundary is not one, and treating it as one costs you the entropy of every human choice in the estate.