How Often Should I Change My Password?

Have You Changed Your Password Lately?

If you use a weak password, such as a name or date, you are asking for trouble. Hackers have software that automatically and rapidly tries thousands of common words until one works. Some "brute force" password hackers cycle through every combination of letters and numbers until one clicks. The shorter and more common your password is, or if it's a common word followed by some numbers, the more often you should change it to stay ahead of such methods.

The more exposed your login screen is, the more often you should change your password. The Windows login screen usually can't be seen by anyone but the person sitting in front of the computer. But you should be aware of "shoulder surfers" lurking behind you. And any login screen accessible via the Internet is more vulnerable.

Using unsecured public WiFi networks can allow hackers to capture your password as you type it into your browser. If you frequently patronize Internet cafés or other public networks, you should change your critical passwords often. See my related article on Wireless Hotspot Security (http://askbobrankin.com/wireless_hotspot_security.html).

If you have ever written your password down on paper, you should change it immediately. The same is true if you have ever told your password to anyone.

If you have detected malware on your computer, change all of your passwords after cleaning up the infection. Also, if you have stumbled across a website which you suspect might be up to no good, change your passwords. In both cases, you may have picked up a keylogger without knowing it. A keylogger captures passwords and transmits them to bad guys.

Secure Password Strategies

Many employers and financial institutions require users to change their passwords once every three to six months. Such policies are compromises between security and convenience. When users have to change passwords often, they may opt for short, easily remembered, and easily hacked passwords.

The stronger your password is, the less often you need to change it. Passwords that are 12 characters or longer and mix upper and lower case letters, numbers, and special characters randomly are much harder to crack - and harder to remember.

That's where password management software comes in. A password manager program stores all of your passwords in an encrypted database and enters the appropriate password when it's needed. RoboForm and KeePass are examples of password managers. With such a utility, you can create complex passwords that are hard to crack and not have memorize them. Of course, you will need a master password to access the password management program. See my article Is Your Password Hacker Proof? (http://askbobrankin.com/is_your_password_hacker_proof.html) for advice on password managers, and choosing a strong, secure password.

There is no hard-and-fast answer to how often you should change passwords. But the longer you keep the same password, the longer hackers have to crack it. If your employer requires you to change passwords on a regular schedule, I suggest change your personal passwords at the same time.

Do you have something to say about password strategies? Post your comment or question below...