Password policies: the questions we get asked most

It comes up on almost every project, usually later than it should. The questions about password policies that come up most often on our calls.

Security is a maintenance habit rather than a purchase, which is why it drifts. Assume whoever inherits this will have half your context and none of your patience.

Do we need to care about this?

Length beats complexity rules. There is a version of this that is over-engineered, and it is worth avoiding. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.

Can it wait until after launch?

Occasionally. More often the post-launch version costs several times the pre-launch one. The cost of getting this wrong is rarely visible on the day it happens.

How do we know it is working?

Check credentials against known breach lists. It is worth being explicit about, because assumptions differ quietly. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.

The short version

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about password policies before you move on:

• Someone can say what the current setup is without going to look
• Length beats complexity rules — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Worth checking on your own setup before it becomes someone else's problem to fix.