How often should you change your passwords?

This advisory explains why routine, scheduled password changes are no longer recommended by NIST/NCSC, noting users tend to choose weaker, similar passwords and gain little security from forced rotations. It outlines when to change passwords (after breaches, credential reuse, weak passwords, malware compromise, sharing, or public/computer logins) and provides best practices: use strong, unique passwords in a password manager (with breach monitoring), enable 2FA and passkeys where available, conduct regular password audits, and avoid saving passwords in browsers.