A short guide to password policies

It comes up on almost every project, usually later than it should. Everything we would tell a client about password policies in the time it takes to drink a coffee.

The realistic threat for most small businesses is automated and opportunistic, not targeted. It is worth deciding this deliberately rather than inheriting whatever the last person set up.

What is actually at stake

Length beats complexity rules. That sounds obvious written down. It is still the thing most often skipped. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.

What good looks like

Forced rotation makes passwords worse, not better. The cost of getting this wrong is rarely visible on the day it happens. Write the reasoning down alongside the decision, because the reasoning is what changes first.

What to watch for

Check credentials against known breach lists. It is worth being explicit about, because assumptions differ quietly. The version that survives contact with a real deadline is the simple one.

What this looks like day to day

Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about password policies before you move on:

• Someone can say what the current setup is without going to look
• Check credentials against known breach lists — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If any of that sounds like a description of your current setup, it is fixable.