It’s Been Eight Years Since NIST Said to Stop Rotating Passwords

In June 2017, NIST published SP 800-63B Rev 3 and told the world to stop requiring periodic password changes. Eight years later, most organizations still do it. In August 2025, NIST published Rev 4 and upgraded that guidance from “you should stop” to “you must stop.”