A practical checklist for password policies

This is cheap to get right at the start and expensive to retrofit. Run through this the next time password policies comes up.

Security is a maintenance habit rather than a purchase, which is why it drifts. Assume whoever inherits this will have half your context and none of your patience.

The checklist

• Length beats complexity rules
• Forced rotation makes passwords worse, not better
• Check credentials against known breach lists
• Someone is named as the owner
• There is a date to review it again

What is actually at stake

Length beats complexity rules. The teams that handle this well are rarely the ones with the biggest budgets. Write the reasoning down alongside the decision, because the reasoning is what changes first.

In practice

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about password policies before you move on:

• Someone can say what the current setup is without going to look
• Length beats complexity rules — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Worth checking on your own setup before it becomes someone else's problem to fix.