Why are we sometimes encouraged to change our passwords periodically? Two reasons:
- Passwords are (hopefully) stored in hashed form, meaning that it is supposed to be impossible to get the plaintext password even if you manage to steal the database. If the password is weak, or the hashing bad, it is possible to brute force the password. This can take time, even on a very fast computer. If you change your password every month, and brute forcing the password takes two months, the attacker is out of luck.
- If say your collegue steals your password by peaking while you type he can read your email and spy on you. If you change your password regularly, you will eventually shut her out.
So changing your password is positive in theory. But it is associated with a cost - having to memorize the new password. If having to pay that cost forces you to take other cheap short cuts in other areas, you may end up less secure because of it.
I would use this priority list:
- Never use stupidly simple top 1 000 passwords like
password1
or 123456
.
- Never reuse the same password on multiple sites.
- Use reasonably strong passwords.
- Change your password every now and then.
If implementing #4 causes you to cheat on #1 - #3 to be able to keep all the passwords in memory, you are doing yourself a disservice. Fortunately, there is an easy way to fullfill #1 - #3 without spending any brainpower at all - just use a password manager. There are plenty of free alternatives.
Even with a password manager you might want to change your password periodically in case someone got hold of it. Good thing is that it is now very easy to do, since you don't need to remember it.