Password Expiration Rules — When You Make People Change Often, What Do They Actually Change?

"Your password will expire in three days"

Monday morning, a notice is waiting in the company inbox. It says your password will expire in three days, so you need to change it to a new one. The new password must be at least eight characters long, include at least one uppercase letter, number, and special character, and cannot be something you used before. You received the same email three months ago.

Behind this notice lie two beliefs. The first is the belief that the more frequently you change it, the safer it is. Even if someone secretly figured out your password, once you change it, what they hold becomes an old key that no longer fits. The second is the belief that the more complex it is, the safer it is. Mixing different types of characters creates more possible combinations, making it harder for others to guess.

Both beliefs sound plausible, and in fact, the rules of many companies and schools look like this. This article follows, based on evidence, how these two beliefs hold up in front of actual people and actual attacks. We state the conclusion first. Rules that force passwords to be changed on set dates have been questioned on whether they achieve the purpose of rendering an attacker's old password useless, and rules that mandate filling various character types have resulted in people filling them in predictable ways. However, the boundary drawn by the evidence stops right there. The conclusion that the act of changing passwords itself is useless is not found in the evidence.

The Strength of a Password Is Measured by the Number of Guesses Needed to Guess It

When evaluated as an anonymized distribution, the passwords chosen by roughly 70 million Yahoo users were much easier to guess than expected. The security provided by passwords was under 10 bits against an attack trying common ones at the login prompt, and about 20 bits against an attack trying the most efficient dictionary using a stolen list (DOI: 10.1109/sp.2012.49). 10 bits of difficulty is equivalent to an attacker achieving the same success rate by guessing one out of roughly 1,000 evenly chosen candidates, and 20 bits corresponds to about 1 million. Since it was "under" 10 bits, it was actually easier than that. This value was calculated from the distribution of all users, not a single person's password.

To read this number, we must first determine what an attacker does. A guessing attack is an attack that tries plausible candidate passwords in order from most common. Unlike brute-force guessing—where every possible key is tried one by one ("Encryption — The Content Is Locked, but the Record of Comings and Goings Remains")—it mimics the order in which people actually choose passwords. Therefore, password research measures strength by "how many guesses it takes to get it right." Methods that simulate actual password-cracking techniques to calculate that number have been used to compare passwords created under different rules (DOI: 10.1109/sp.2012.38), and graphs plotting the number of guesses have become a widely used method in this field (DOI: 10.1109/sp.2014.50).

There are two places where an attacker tries guessing. One is the login prompt. Here, the account locks after a few wrong tries, so only a small number of attempts can be made. The other is when a stolen list from a server is guessed on the attacker's own computer, in which case trillions of guesses are also possible (DOI: 10.1184/r1/6720701, Ph.D. dissertation). "Passwords and Passkeys — How Do You Prove You Are You?" covered how, even if a server stores passwords as hashes converted into short values, candidates can be transformed and matched one by one in the same way.

What was even more surprising in the Yahoo data was that there was almost no difference. Any identifiable group chose similarly weak passwords. Even groups that seemed to have reason to care about security, such as users who registered payment cards, showed no greater difference than demographic factors like age or nationality. Far-flung language regions also chose the same weak passwords (DOI: 10.1109/sp.2012.49).

Passwords chosen by humans are guessed in a similar order no matter who picks them, and their strength is determined by where they fall in that order.

How Far Does a Changed Password Move from the Old One?

Password expiration is a rule that stops people from using their current password and forces them to create a new one after a set period of time. It is also commonly called mandatory periodic rotation. The goal of this rule is clear. It is to cut off access for an attacker who has gotten hold of the password (DOI: 10.1145/1866307.1866328).

A 2010 study that measured for the first time on a large scale whether this goal is actually achieved used data from more than 7,700 accounts. The researchers measured how much of an obstacle the new password chosen by the user due to expiration is to an attacker holding the old password. They built a framework to start from the old password and search for the new one, and even devised a method to construct a nearly optimal search order to measure that difficulty. The authors concluded that this study casts doubt on the value of continuing to enforce password expiration (DOI: 10.1145/1866307.1866328). Expiration is a rule intended to make the old password held by an attacker useless. Yet if the new password can be found starting from the old one, the old password held by the attacker is still used as a starting point.

There is also the perspective seen from the user side. One university presented users with four randomly generated passwords when creating a password, required them to follow strict rules if they made their own, and made all passwords expire after 120 days. When surveying members of that university twice, most chose to make their own, used coping strategies that undermined the security of the requirements, and answered that the expiration period was too short. The authors concluded that random passwords, strict requirements, and short expirations are unusable security demands for most people, and that they cause people to bypass requirements and reuse passwords (DOI: 10.1002/sec.1184, survey study). These are results reported by people themselves, not an examination of actual passwords.

There is also an explanation of why this happens. A 2017 paper notes that when expiration forces people to change passwords, they usually make weaker passwords each time they change them. The explanation is that because the effort of memorization cannot be paid off distributed over a long period, people use passwords they are certain they will not forget (DOI: 10.1109/issa.2017.8251779). This is an explanation put forward by the authors of that paper as the starting point of their research, and the experimental results of the same paper will be looked at again in a later, contrasting section.

Expiration is a rule intended to neutralize an attacker's old password, but if the new password a person chooses can be found from the old one, that purpose is weakened.

What the Rule to Mix Character Types Actually Created

Carnegie Mellon University in the United States significantly changed the computer service password policy, making all users create new passwords. When 470 users were surveyed at that time, most were annoyed by having to create a complex password, but they believed it was now more secure (DOI: 10.1145/1837110.1837113). The feeling that it became as secure as the inconvenience endured remained.

Composition rules are rules that determine the minimum length of a password and the types of characters that must be included. Requirements to include a few types among uppercase letters, lowercase letters, numbers, and special characters are typical. These rules were created to proactively block easily guessed passwords and make them difficult for attackers to guess (DOI: 10.1145/2891411). The National Institute of Standards and Technology (NIST) in the U.S., an agency that creates technical standards for the U.S. government, along with several other places, issued guidelines for these rules. A 2016 doctoral dissertation notes that those guidelines had never been confirmed by empirical evidence, and that their research team and other researchers found them to be incorrect (DOI: 10.1184/r1/6720701, doctoral dissertation).

The gaps between the rules and the results are numerous. A large-scale study comparing the strength, user behavior, and emotions of passwords created under four composition rules found that several common beliefs about composition and strength are incorrect (DOI: 10.1145/1978942.1979321). In one study, composition rules reduced the extent to which passwords resembled dictionary words. However, in that case, they neither reduced the inclusion of meaningful information like names and birthdays nor the reuse of passwords (DOI: 10.1080/0144929x.2010.492876). A 2025 analysis examined 14 million user passwords extracted from leaked data. Among them, 44% contained predictable substitutions like using @ instead of a, and the authors considered that these substitutions passed complexity demands without increasing security (DOI: 10.4314/jasem.v29i11.8, single analysis). The characters desired by the complexity requirements could be filled, but the method of inclusion was predictable.

What happens if length is required instead of character types? An online experiment involving 8,143 participants compared eight rules, including the traditional rule of "8 characters or more, four character types, passing a dictionary word check," with the rest all being rules that required longer passwords. Among the longer rules, there was a trade-off between security and usability, so no single rule excelled in both. However, several of them were easier to use and more secure than the traditional rule (DOI: 10.1145/2556288.2557377). In two large-scale online studies comparing 15 rules, strength and usability did not necessarily move in opposite directions. There were rules that were easier to use and more secure than common rules emphasizing complexity, and several of the rules compared in this study focused on length requirements (DOI: 10.1145/2891411). Both studies are online experiments where participants used passwords they created for the experiment.

Rules requiring character types make passwords look complex, but people fulfilled those requirements in predictable ways, and in online experiments, several rules that required longer passwords were both stronger and easier to use.

A Monday Morning Notice of Expiration

We return to that office worker on a Monday morning. We measure the evidence we have seen so far against this person's life, five minutes at a time.

He must memorize a new password, and change it again three months from now. The authors of a 2017 paper explained at the starting point of their study that when the effort of memorization cannot be paid back over a long period, people choose passwords they are certain not to forget (DOI: 10.1109/issa.2017.8251779). The experiment in the same paper produced the opposite result when the conditions were changed.

The way people retrieve things from memory when choosing a new password was confirmed when they signed up for a new site. In one survey, 77.38% of respondents answered that when choosing a password for a new service, they either used an existing password from memory as-is or modified it slightly (DOI: 10.1109/dsn.2016.60). In another survey targeting students, about two-thirds of password uses overlapped with other places, and more than half of the respondents wrote down their passwords somewhere (DOI: 10.1002/acp.1014).

In one case where composition rules were imposed, the degree of resemblance to dictionary words decreased, but information like names and birthdays remained unchanged (DOI: 10.1080/0144929x.2010.492876). The requirements could also be met with predictable substitutions (DOI: 10.4314/jasem.v29i11.8, single analysis). He followed all the rules, and the mail announces "Change Complete."

Now we look from the attacker's side. If an attacker holds this person's old password, that very old password becomes the starting point for finding the new password (DOI: 10.1145/1866307.1866328). The same applies even if they hold his password leaked from another site. These attacks work because people use the same or similar passwords across multiple sites. In a simulation that trained a model on how passwords resemble each other using 1.4 billion leaked email-password pairs, if an attacker knew just one of that person's other passwords, more than 16% of accounts were cracked in fewer than 1,000 attempts, even with the latest defenses of the time (DOI: 10.1109/sp.2019.00056).

The lock was replaced every three months, but if the new key is just the old key reshaped slightly, the person holding the old key starts out right near the correct key.

Where the Guidelines Have Moved — Length, Leak Lists, and Strength Meters

NIST's password guidelines were updated in June 2017. One of the new guidelines regarding how passwords are managed and accepted was the requirement that the party receiving the password check whether the password submitted by the user is already included in previous leak data (DOI: 10.48550/arxiv.1805.02931, preprint). Checking for leaked passwords is the process of verifying whether a password you are trying to set is already on a list of passwords that have leaked out, and rejecting it if it is. If we list them starting from the most common guesswork attacks, passwords that are on already-published lists come earlier in that sequence. However, common leak checks have the limitation that they filter out identical passwords but fail to filter out slightly modified variations, a topic covered in "Passwords and Passkeys — How Do You Prove You Are You?". The same revision (NIST SP 800-63B, 2017) changed its recommendations to require changing passwords only when there is evidence of a leak rather than at set intervals, and to stop separately enforcing composition rules such as mixing different types of characters.

Even several years after the guidelines changed, field rules lagged behind. When the authentication policies of 135 universities in the US and Canada were tested against the four criteria of the NIST guidelines, the outdated use of password expiration and composition rules was common (DOI: 10.48550/arxiv.2409.00546, preprint). In a study that directly inspected 100 popular websites, an average of 53.5% did not follow NIST's composition rule guidelines (DOI: 10.1109/spw59333.2023.00006).

Demands regarding length do not end there. A 2020 study addressing how to crack long passwords found that, in actual leak datasets, an average of 23.30% of 16-character passwords were cracked within 100 trillion guesses. The authors recommended making passwords long by combining four or more distinct blocks of different types—such as numbers, words, and years—rather than just increasing the variety of characters (DOI: 10.1109/tifs.2020.3003696). While length increases the number of guesses required to crack a password, human-made patterns still remain even in long passwords.

There are also tools designed to help at the moment a password is created. A strength meter is an indicator displayed as a bar or words that shows whether a password is weak or strong at the exact moment it is being created. The effectiveness of these meters varied depending on the situation. In a laboratory setting where participants were forced to change their actual passwords, the presence of a meter made passwords noticeably stronger. In a field experiment creating new, unimportant accounts, the meters did not make a noticeable difference, and participants reused weak passwords they had been using for similar low-risk accounts. The authors concluded that meters are effective when forcing password changes for "important" accounts, and that the detailed design of the meter has a minor impact (DOI: 10.1145/2470654.2481329).

Sometimes the meter's own judgments were hard to trust. When common passwords were fed into the meters of popular websites, the same password received vastly different judgments from different meters, and several weak passwords received "strong" or "very strong" ratings (DOI: 10.14722/ndss.2014.23268). Conversely, a meter that combines neural networks and rules to show accurate scores and specific areas for improvement led users to create passwords that were both safer and no harder to remember than meters showing only a bar, under more common composition rules tested in an online study (DOI: 10.1145/3025453.3026050).

The guidelines have shifted away from set intervals and superficial complexity, toward filtering out passwords that have already leaked or are easy to guess.

Where the Evidence Conflicts — When Expiration Is Used as a Reward, and After Hearing of a Leak

Expiration, which rewards strong passwords with a long validity period, produced the opposite result in an actual university web service. Three long-term studies took place on that service, altering the screen where passwords are chosen. In the first two studies, light nudges changing screen text and images failed to move password strength. The third study tied the expiration date directly to password strength. Choosing a stronger password allowed it to be used longer. This method clearly produced longer and stronger passwords, and the authors concluded that clearly demonstrating the benefits of strong passwords made the difference (DOI: 10.1017/bpp.2018.3).

A 2017 conference paper also reported a long-term study of the same intervention—tying the expiration period to strength—and contrary to expectations, participants chose stronger passwords when making changes. Those authors interpreted that changing passwords is harder than memorizing a single strong password, and recommended using expiration only when the risks justify that burden (DOI: 10.1109/issa.2017.8251779). Both are reports covering the same type of intervention, and the three studies are results obtained from a single university's service.

This result appears to collide with the earlier evidence, but the two sides measured different expirations with different data. The 2010 account data looked at expiration rules that were actively enforced, whereas the university's long-term study looked at expiration that rewarded strong passwords with long validity periods. There is no evidence directly comparing within a single study why the two results diverged.

Gaps also remain in the approach of prompting changes after a leak. This approach relies on people actually changing their passwords after hearing news of a leak. In a public server version study looking at actual password data from 249 participants, 63 people had accounts on leaked sites. Among those 63 people, only 33% changed their passwords, and only 13% changed them within three months of the leak announcement. When comparing strength values converted to logarithms, the new passwords were on average 1.3 times stronger, but most were weaker or the same, and they were instead more similar to the person's other passwords. They almost never changed the passwords on other sites where they used the same or similar passwords. The authors concluded that stricter change requirements and more effective leak notifications are needed after a leak (DOI: 10.48550/arxiv.2010.09853, preprint).

Attempts to bridge this gap with notification messages worked only partially. Of 180 respondents who saw one of six representative notification messages that companies send when reuse is suspected, less than a third answered that they would change any password. Even when subsequently shown 15 refined notification messages, the actions they said they would take were still vulnerable to the next reuse attack (DOI: 10.1145/3243734.3243767). In one online experiment, participants who received both a threat-emphasizing message and a message explaining how to change passwords actually changed their passwords more than the comparison group, but the authors considered such interventions useful yet insufficient to drive changes (DOI: 10.1145/3689432). On a test site that informed users of email leaks on the signup screen, 64% of 373 participants had leaked accounts at least once, and in a follow-up survey three days later, 40% reported changing passwords for some accounts (DOI: 10.1080/10447318.2024.2404721). There were also field attempts to elicit changes through general education rather than leak notifications. At a German company with 2,000 employees, password security training was sent out twice each over six weeks via email, the internal web page, and videos, but the password change rate was very low and no method clearly elicited more changes than the comparison group (DOI: 10.1145/3487405.3487653).

There are three main reasons why the research conflicts. First is what is being measured. Responses saying "I will change it" and actual changes differ, and the aforementioned surveys, online experiments, and actual password data lie on that boundary. Strength also varies depending on which guessing method is used to measure it. In a study systematically comparing multiple models that simulate passwords by probability, a properly built family of models fit significantly better than the model used as the standard at the time (DOI: 10.1109/sp.2014.50). Second is which passwords are being looked at. Most studies look at only one or a few passwords per user, often rely on passwords created for the study or passwords for unimportant accounts, and a 2017 study notes that these limitations severely constrain the understanding of actual password security (DOI: 10.1145/3133956.3133973). Third is which accounts they are. Just like the meter experiment earlier, people behaved differently between important accounts and unimportant accounts (DOI: 10.1145/2470654.2481329).

What the evidence questioned is expiration that forces changes on a set schedule, whereas expiration rewarding strength produced opposite results at a single university, and changes after leaks were rare even when they needed to happen.

What Remains Even After Fixing the Rules — Reuse and Fake Login Screens

No matter how well you design the rules, they are still the rules of just a single site. A 2006 study surveying 49 college students found that most had three or fewer passwords, and as their accounts grew over time their passwords did not, leading to a steady increase in reuse (DOI: 10.1145/1143120.1143127). Even if one site requires length and checks breach lists, if the same password was used elsewhere and leaked there, it becomes fuel for credential stuffing — an attack where a password stolen from one place is used to log into the victim's other accounts ("Passwords and Passkeys — How Do You Prove You Are You?").

Password managers — programs that remember passwords for multiple sites on your behalf and retrieve them when you log in, commonly recommended as a tool to stop password reuse — have not been widely adopted. In a 2020 paper combining three studies, the main reason for low adoption was a lack of trust and transparency rather than difficulty of use (DOI: 10.3390/fi12110189). In a study observing 32 people who used managers, many avoided the passwords generated by the managers. This was because it was hard to type and remember those passwords when the manager could not be used (DOI: 10.1145/3491102.3517534).

There are also paths that length and breach lists cannot block. No matter how long and unbreached a password is, if you type it directly into a fake login screen disguised to look real, it is handed right over. "Phishing and Social Engineering — Ringing the Doorbell Instead of Breaking the Lock" covers such deceptions, while "The Limits of Two-Step Verification — Which Visitors Can Still Open the Second Door?" addresses what asking for one more piece of evidence beyond a password can and cannot stop.

Fixing password rules makes passwords on a single site harder to guess, but the inherent limits of passwords themselves — reuse and fake login screens — cannot be closed by rules alone.

Significance — When and Why Are Users Made to Change Them?

Let us return to the first two beliefs. The belief that "the more frequently you change them, the safer they are" aimed to cut off an attacker who got their hands on a password. However, the authors of the study that measured the difficulty of finding a new password from an old one cast doubt on the value of that practice. The belief that "the more complex, the safer" is true if the number of attempts needed to guess it increases. Yet people fulfilled character-type requirements in predictable ways, and in an online experiment, several rules requiring length fared better.

Evidence in the opposite direction also stands in the same place. Expiration, which rewards a strong password with a long usage period, produced stronger passwords at a university, and even a 16-character password was guessed on average 23.30% of the time within 100 trillion guesses in the face of a new guessing method from one study. Making users change passwords when there is evidence of a breach is the direction guidelines have shifted, and the authors of the breach study also said to require it more strictly, but in reality, people did not change them well even then.

What the evidence called into question is "the rule to change them on set dates by fulfilling character types," and what the evidence left behind is "changing passwords when they leak" and the problem that people do not change them well even then.

How passwords are written on servers and why a password leaked in one place opens another door are covered in "Passwords and Passkeys — How Do You Prove You Are You?". The real-world effectiveness and loopholes of verification methods that do not rely on a single password continue in "The Limits of Two-Step Verification — Which Visitors Can Still Open the Second Door?", and the trick of obtaining passwords through fake login screens continues in "Phishing and Social Engineering — Ringing the Doorbell Instead of Breaking the Lock".

Source Papers

• "The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords" (2012) — DOI: 10.1109/sp.2012.49 — Distribution of anonymized passwords from approximately 70 million Yahoo users. Under 10 bits for online random guessing, and about 20 bits for optimal offline dictionary attacks. Little variation between groups, security motives such as registering a payment card have no greater effect than demographic factors, and graphic feedback encouragement shows a small difference.
• "Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms" (2012) — DOI: 10.1109/sp.2012.38 — 12,000 passwords collected online under seven composition rules, evaluated by guess count mimicking password-cracking algorithms. The relationship between guess resistance per rule and entropy estimation.
• "A Study of Probabilistic Password Models" (2014) — DOI: 10.1109/sp.2014.50 — Guess count graphs are a widely used method in password research. Systematically comparing probabilistic models, a properly constructed Markov model clearly outperforms PCFG by Weir et al.
• "Modeling the Adversary to Evaluate Password Strength With Limited Samples" (2016, Ph.D. dissertation) — DOI: 10.1184/r1/6720701 — Composition rule guidelines from NIST and others lacked empirical validation and researchers found them inaccurate. An offline attack model capable of trillions of guesses and an online attack model limited to a small number of attempts before lockout.
• "The security of modern password expiration" (2010) — DOI: 10.1145/1866307.1866328 — The purpose of expiration is to block access by an attacker who has obtained a password. With over 7,700 accounts, constructing a framework to find new passwords from old ones and a near-optimal search strategy to measure that difficulty. Questioning the value of continuing the practice of expiration.
• "Why we hate IT: two surveys on pre-generated and expiring passwords in an academic setting" (2015) — DOI: 10.1002/sec.1184 — A university with four random passwords presented, strict requirements, and 120-day expiration. Most create their own, use workarounds that undermine security, and report that expiration is too short. Such requirements are unusable security and produce workarounds and reuse.
• "Enriched nudges lead to stronger password replacements … but implement mindfully" (2017) — DOI: 10.1109/issa.2017.8251779 — Replacing passwords due to expiration usually gets weaker over time (as the effort to memorize cannot be shared, leading to unforgottable passwords). In interventions combining variable expiration based on strength, participants instead switched to stronger passwords. Expiration should be used only when the risk justifies the burden.
• "Encountering stronger password requirements" (2010) — DOI: 10.1145/1837110.1837113 — Survey of 470 users who changed passwords following a Carnegie Mellon University policy change. Most were annoyed by complex passwords but believed they became more secure.
• "Designing Password Policies for Strength and Usability" (2016) — DOI: 10.1145/2891411 — Composition rules emerged to prevent easily guessed passwords. In two online studies with over 20,000 people comparing 15 rules, strength and usability are not necessarily inversely proportional, and there are rules that are easier to use and more secure than complexity-centric rules (many of the compared rules are length-centric).
• "Of passwords and people" (2011) — DOI: 10.1145/1978942.1979321 — A large-scale study comparing strength, behavior, and emotion under four composition rules. Several common beliefs about composition and strength are inaccurate.
• "Impact of restrictive composition policy on user password choices" (2010) — DOI: 10.1080/0144929x.2010.492876 — Composition rules reduced similarity to dictionary words, but in this case failed to reduce the use of meaningful information such as names and birthdays, and reuse.
• "Password Strength and Weaknesses in common User-Generated Passwords and their Susceptibility to PassGAN AI-Based Cracking" (2025, single analysis) — DOI: 10.4314/jasem.v29i11.8 — Analysis of 14 million user passwords from RockYou2021. 44% pass complexity requirements with obvious substitutions like @ instead of a without increasing security. Recommends length-centric approaches and breach-based blocklists instead of complexity.
• "Can long passwords be secure and usable?" (2014) — DOI: 10.1145/2556288.2557377 — Online experiment with 8,143 people, comparing 8 rules including traditional rules (8 characters, 4 types, dictionary check) (the rest are long rules). Among long rules there are trade-offs, but several are easier to use and more secure than traditional rules.
• "What was that site doing with my Facebook password?" (2018) — DOI: 10.1145/3243734.3243767 — Less than a third of 180 people who saw six actual reuse notices intended to change their passwords. The intended behavior of 588 people who saw 15 variations is also vulnerable to reuse attacks. Notices alone are insufficient.
• "Does my password go up to eleven?" (2013) — DOI: 10.1145/2470654.2481329 — When real passwords were forcibly changed in a lab, meters produced stronger passwords, but in a field experiment creating low-value accounts there is no difference and weak passwords are reused. Meters are effective for forced changes on important accounts, and detailed design impact is small.
• "From Very Weak to Very Strong: Analyzing Password-Strength Meters" (2014) — DOI: 10.14722/ndss.2014.23268 — Popular website meters give very different verdicts to the same password and display weak passwords as strong or very strong.
• "Design and Evaluation of a Data-Driven Password Meter" (2017) — DOI: 10.1145/3025453.3026050 — A meter combining neural networks and rules. In an online study of 4,509 people under more common composition rules, detailed feedback led to passwords that were more secure and no harder to remember than a meter with only a bar.
• "fuzzyPSM: A New Password Strength Meter Using Fuzzy Probabilistic Context-Free Grammars" (2016) — DOI: 10.1109/dsn.2016.60 — In a user survey, 77.38% retrieved and reused an existing password or slightly modified it for a new service password. Proposing a meter reflecting this.
• "Generating and remembering passwords" (2004) — DOI: 10.1002/acp.1014 — Student survey. About two-thirds of password uses are duplicates, over half are written down, and names and birthdays make up about half of composition.
• "Beyond Credential Stuffing: Password Similarity Models Using Neural Networks" (2019) — DOI: 10.1109/sp.2019.00056 — Targeted attacks work because people use the same or similar passwords. Trained on 1.4 billion leaked pairs, knowing one other password cracks over 16% of accounts in under 1,000 attempts even against state-of-the-art defenses (simulation).
• "Do Smarter People Have Better Passwords?" (2018, preprint) — DOI: 10.48550/arxiv.1805.02931 — NIST required in its June 2017 new guidance that user-submitted passwords be checked against previous breach data. Compared student grades against 320 million leaked passwords.
• "Measuring NIST Authentication Standards Compliance by Higher Education Institutions" (2024, preprint) — DOI: 10.48550/arxiv.2409.00546 — Compliance with the four NIST SP 800-63 standards across 135 U.S. and Canadian universities. Multi-factor authentication is widely (though not universally) used, but legacy use of password expiration, composition rules, and knowledge-based authentication is common.
• "Evaluating Password Composition Policy and Password Meters of Popular Websites" (2023) — DOI: 10.1109/spw59333.2023.00006 — Inspected 100 popular websites; an average of 53.5% do not follow NIST composition rule guidelines.
• "TransPCFG: Transferring the Grammars From Short Passwords to Guess Long Passwords Effectively" (2020) — DOI: 10.1109/tifs.2020.3003696 — Actual breach dataset, an average of 23.30% of 16-character passwords cracked under $10^{14}$ offline guesses. Recommends long passwords with four or more chunks rather than character types.
• "Nudging folks towards stronger password choices: providing certainty is the key" (2018) — DOI: 10.1017/bpp.2018.3 — Three long-term studies on an actual university web service. Visual nudges had no effect, but tying expiration dates to strength resulted in markedly longer and stronger passwords. Certainty of benefit made the difference.
• "(How) Do people change their passwords after a breach?" (2020, preprint) — DOI: 10.48550/arxiv.2010.09853 — Actual password data for 249 people. Only 33% of 63 people with accounts in breached domains changed them, and 13% within three months. New passwords are on average 1.3 times stronger on a logarithmic scale, but mostly weak or the same and more similar to other passwords. Almost no changes are made on other sites. Requires stricter change requirements and more effective guidance after a breach.
• "Encouraging Users to Change Breached Passwords Using the Protection Motivation Theory" (2024) — DOI: 10.1145/3689432 — Online experiment with 1,386 people. Threat appeals increased intention to change, and receiving both appeals increased actual changes, but interventions alone are insufficient.
• "Investigating Effectiveness of Informing Users About Breach Status of Their Email Addresses During Website Registration" (2024) — DOI: 10.1080/10447318.2024.2404721 — On a trial registration site, 64% of 373 people had a breach history. In a follow-up survey three days later, 40% changed passwords for some accounts.
• "It is not as simple as that: Playing out password security trainings in order to nudge password changes" (2021) — DOI: 10.1145/3487405.3487653 — A German company with 2,000 employees, 140 per group, for 6 weeks. Change rates were very low and no training format produced significantly more changes than the control group.
• "Let's Go in for a Closer Look" (2017) — DOI: 10.1145/3133956.3133973 — Most studies rely on one or a few passwords per user, research-created passwords, or low-value accounts, and these limitations severely constrain understanding of real password security.
• "Password management strategies for online accounts" (2006) — DOI: 10.1145/1143120.1143127 — 49 college students. Most have three or fewer passwords, and as accounts increase while passwords do not, the reuse rate rises.
• "Password Managers—It's All about Trust and Transparency" (2020) — DOI: 10.3390/fi12110189 — Three studies. Low adoption of password managers is driven primarily by a lack of trust and transparency rather than usability.
• "“It Basically Started Using Me:” An Observational Study of Password Manager Usage" (2022) — DOI: 10.1145/3491102.3517534 — Observational interviews of 32 password manager users. When managers cannot be used, input and memorization are difficult, so they avoid generated passwords.