Do you really need to change every password after a breach? What NIST says
What NIST's 2025 password rules say about changing passwords after a breach, and exactly which passwords to change.
Tap a step number as you finish it.
When a company you use suffers a data breach, the usual advice is to change all your passwords. But changing passwords that were never exposed may create unnecessary work without improving security.
NIST, the US standards body whose digital identity guidelines influence password policies, takes a more targeted approach. This guide explains what NIST's latest rules say, which passwords to change, and how to protect your accounts afterwards.
The short answer
Yes: change the password on the breached account, and on any other account that shares it. Do it straight away.
You do not need to change other, unique passwords just because a breach happened somewhere else. NIST's rules are written for organisations, but they tie password changes to evidence of compromise, not to the calendar or to news headlines.
What NIST is, and why its rules matter
NIST stands for the National Institute of Standards and Technology, a US government agency. Its Digital Identity Guidelines cover how government information systems authenticate people, and many other organisations choose to follow them.
Those rules apply to organisations, which NIST calls verifiers and credential service providers. They are not instructions for individuals.
NIST marks strict requirements with the word shall and recommendations with the word should. That difference matters, because only some of the password rules below are firm requirements.
But they are built on research into how passwords fail, so they are a reliable guide to what actually keeps your accounts safe.
What the latest NIST rules say about changing passwords
NIST published the final version, SP 800-63B-4, on July 31, 2025. It supersedes the earlier SP 800-63B.
Section 3.1.1.2 sets out the rule on changes. Services must not force people to change passwords on a regular schedule. The exception is evidence of compromise: if a password may have been exposed, the service must force a change.
In other words, NIST does not say passwords never need changing. It says a change should be triggered by evidence, not by a schedule.
Good to know
Earlier versions only recommended against forced periodic changes. The 2025 version turns that into a firm requirement for the systems it covers.
What counts as evidence of compromise
For your own accounts, these are reasons to investigate and, where appropriate, change your password:
A breach notice
The service confirms your password or login credentials were exposed.
A breach listing
The account appears in an incident that included passwords or other login credentials.
A password checker warning
Password Checkup or your password manager flags the password as leaked.
Reuse
You used the same password on a service whose credentials were compromised.
Suspicious activity
Unfamiliar sign-ins or account changes mean you should secure the account and investigate straight away.
If none of these apply to an account with a unique, long password, NIST's reasoning suggests leaving it alone.
If the breach involved card or identity details, follow the steps in our guide to what to do after a data breach as well.
Free tools such as Have I Been Pwned and Mozilla Monitor will tell you whether your accounts appear, and we compare them in a separate guide.
Which passwords to change after a breach
Work through your accounts in this order, so the most important ones are secured first.
- Change the password for the breached service.
- Change every other password that was the same.
- Start with your email account, because it can reset all the others.
- Move on to banking, your phone account and any account holding payment details.
- Turn on two-factor sign-in or a passkey on each account you change.On
Did these steps work for you?
Watch out
NIST does not class every similar password as compromised. Still, a small variation, such as adding a number, is easy to guess if the original has leaked, so give each account a password of its own.
How long your new password should be
Length matters more than anything else. Under SP 800-63B-4, services that accept a password as the only sign-in factor must require at least 15 characters.
When a password is only one part of multi-factor sign-in, NIST allows services to accept a shorter one, but never under eight characters. Services should also let you use 64 characters or more, which leaves room for long passphrases.
Tip
Let a password manager create and store a long, unique password for each account. For the few you must type yourself, a passphrase of several unrelated words is long and easier to remember.
Why complex rules are out
You have probably been told to mix capital letters, numbers and symbols. NIST's current rules tell services not to impose these composition rules at all.
Research behind the guidelines found that such rules push people towards predictable patterns, like a capital letter at the start and a number at the end. Length and uniqueness protect you far better than a forced symbol.
Other NIST rules that help you
SP 800-63B-4 includes several more requirements for services that make passwords work better for the people using them.
Blocklists
Services must check new passwords against a list of common, expected or compromised passwords and reject matches.
Password managers
Services should allow you to paste passwords, so password managers work properly.
No hints or security questions
Services must not rely on password hints or questions such as your first pet's name.
Full checking
Services must check the whole password, not just the first part of it.
If a site rejects your new password because it appeared in a breach, that is the blocklist working as intended. Choose a different one.
When a site forces you to change anyway
Many organisations still require changes every few months. NIST's rules apply to US government systems, so private companies are free to set their own policies.
If you must change a password on a schedule, change it to a completely new password rather than a variation. A password manager makes this painless.
A forced change is not automatically a security improvement. Check the request is genuine by going to the service directly, not by following a reset link in an email.
Frequently asked questions
Should I change all my passwords after a breach?
No. Change the breached account's password and any password you reused. Unique passwords on other accounts do not need changing because of someone else's breach.
What does NIST say about changing passwords every 90 days?
Under SP 800-63B-4, services cannot force routine password changes. Changes should follow evidence of compromise instead.
How long should a password be under NIST's latest rules?
At least 15 characters if the password is your only sign-in factor, and at least eight if it is paired with other factors.
Do NIST's rules apply to my bank or email provider?
They apply to US government systems. Many companies follow them voluntarily, but they are not required to.
Is a passphrase better than a complex password?
For passwords you must remember, usually yes. A long passphrase of unrelated words meets NIST's length rules and is easier to type than a short, complex password.
Does two-factor sign-in mean I can use a weak password?
No. NIST allows shorter passwords only as part of multi-factor sign-in, and a long, unique password still protects you better.
A quick checklist
From circuittimes.com/security/change-password-after-breach/
Was this guide helpful?
What went wrong?
Read nextExplainer 15 min readPrivileged Access Management ExplainedPrivileged access management explained: what PAM means, examples, how it works, tools and PAM jobs, using NIST and Microsoft.
Explainer 8 min readSingle Sign-On (SSO) Explained in Plain English
Comparison 10 min readMFA Methods Ranked From Weakest to Strongest
Explainer 12 min readZero Trust Explained Without the Buzzwords
The briefing, without the noise.
The stories that matter in technology, every weekday morning.
Free. Unsubscribe in one click.