Password policy
The rules governing password length, complexity, reuse, and expiry.
Guidance has shifted substantially. Forced periodic expiry is now discouraged because it drives predictable incremental changes, and complexity rules produce passwords that are hard for humans and easy for machines.
Current best practice favors longer passphrases, screening against known breached passwords, and changing credentials on evidence of compromise rather than on a calendar.
Where this comes up
Password policy sits inside our identity and access work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
Password manager Software that generates, stores, and fills unique passwords so people do not have to remember or reuse them. Passwordless authentication Signing in without a password at all, using a device, biometric, or security key instead. Credential stuffing Using username and password pairs stolen from one breach to log into unrelated services. Password spraying Trying one common password against many accounts, rather than many passwords against one account.