If a user has to change their password ever so often, is it a good thing to check it against zxcvbn or similar library and assign a expiration date relative to the risk of the hash being cracked?

1 Answer 1


No. Password expiration is not to protect against hashes to be cracked. Password expiration is rather to prevent that a hacker does not have unimpeded access to a previously compromised account - that was compromised lets say due to shoulder surfing.

If a hacker does have such a access to a system so he could obtain the password hashes, it often means the hacker has sufficent access to the system in question so the hacker wont need to authenticate.

I would suggest instead using variable expiration times that is in sync with access level. Eg, a regular user that does not have access to anything except a workstation with internet access, can have a password with less requirements and no expiration. A medium user that has access to some confidential data, could for example have a stronger password policy and expiration lets say each 6 month. And limited/local sysops/sysadministrators then have a even stronger password policy and password expiration after 90 Days. And global administrators could simply have the strongest password policies and 30 Days of expiration.

If the system in question is custom one, for example a custom web interface or such, you could code that the password expiration and complexity requirements is directly derived from the encoded access level for the user in question. (And of course, you could create a complexity factor out of password length and complexity, allowing a longer password to replace a complex one and vice versa)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .