Password rotation: when changing a password actually helps

Why forced rotation fell out of favour

When people are told to change a password on a schedule, they rarely invent a new one. They increment a number, move a symbol, or swap a season: Autumn2025! becomes Winter2025!. An attacker who has the old password can guess the new one with a handful of variations. Rotation also adds friction, and friction is what makes people reuse. Current guidance therefore treats periodic rotation without evidence of compromise as unnecessary — and sometimes as actively harmful.

Rotate immediately when any of these is true

• The service announced a breach. Even if you are not sure your account was in the exposed set, the cost of rotating is a minute.
• You may have been phished. If you typed the password into a page you are not certain about, assume it is gone. Rotate first, investigate afterwards.
• The password travelled through a shared channel. Chat messages, screenshots, tickets, a whiteboard photo, or a password sent "just this once" by e-mail.
• Someone with access has left. Shared mailboxes, admin panels, Wi-Fi and door codes are the usual suspects.
• A device that had it cached was lost or sold. Browsers and handsets keep credentials far longer than people expect.
• You found it in a dump or a breach-checker. Treat any appearance of that password as permanent; never use it again anywhere, in any variation.

Rotate on a schedule only in these cases

A small number of secrets cannot use two-factor authentication and are valuable enough to deserve a fixed rhythm: shared admin accounts on a legacy system, a firmware account on a device that cannot be updated, a service account embedded in old software. If a secret is shared between people, a calendar reminder is the practical control — because there is no way to know who still has it.

What makes rotation cheap

Rotation is only painful when the password is reused. If every account has its own generated password stored in a manager, then "rotating" is: generate, paste, save, close the tab. The rules below keep it that way:

• One password per service, always generated — never typed twice by hand.
• Nothing in a spreadsheet, a notes app or a browser's built-in save prompt unless it is your manager.
• Two-factor authentication wherever it exists, so a password leak alone is not enough.

The minute-long workflow

1. Open the generator: length 24, all four character sets on.
2. Leave Exclude ambiguous characters ticked if you ever have to read the password aloud or retype it from a screen.
3. Copy it and paste it into the "change password" form.
4. Let the manager save the new value, then confirm the old one no longer works.
5. Turn on two-factor authentication if you have not already — that matters more than the next rotation.

A note on "changing" a leaked password

If the password appeared in a public dump, changing it on one site is not enough: any other account where you used the same string is now just as exposed. That is the real reason unique passwords matter, and the reason this tool exists in the first place.