A password audit at a 600-person company finds 41 accounts using passwords that appear in public breach lists, 112 passwords built from a season and a year, and nine former employees with enabled accounts. None of it required an advanced attacker to find. Each finding is a gap an attacker could discover in an afternoon.
On the CompTIA Security+ SY0-801 exam, password concepts, passkeys and access reviews are part of objective 4.5. This lesson covers the password settings you'll see in scenario questions and how current guidance has changed them, password managers, passwordless sign-in and passkeys, and the monitoring, auditing and review work that keeps credentials and access from going stale. How systems store passwords safely is covered in the hashing and salting section.
Length does more for a password than complexity rules
Each character added to a password multiplies the number of possibilities an attacker must try. An 8-character password drawn from all 95 printable characters has about 6.6 × 10^15 combinations. A 16-character passphrase of lowercase letters alone has about 4.4 × 10^22, millions of times more, and is easier to remember.
Real attackers don't guess blindly, though. They start with wordlists of leaked passwords and apply rules that mimic how people satisfy complexity requirements: capitalize the first letter, put a digit and a symbol at the end, swap a for @. That's why complexity rules underperform. A user told to include uppercase, lowercase, a number and a symbol produces Summer2026$, which meets the policy and falls to the first round of cracking rules.
CompTIA expects you to know complexity as a setting. In Windows, "Password must meet complexity requirements" demands characters from at least three categories, such as uppercase, lowercase, digits and symbols, and rejects passwords containing the account name. NIST's current digital identity guidelines (SP 800-63B) take a different line:
- Require at least 15 characters when a password is the only factor, and at least 8 when it's one part of MFA.
- Allow long passwords, at least 64 characters, including spaces, so passphrases work.
- Don't impose composition rules such as required character types.
- Screen every new password against lists of breached, common and context-specific passwords, such as the company name.
- Don't use hints or knowledge-based security questions.
Reuse across sites is the other big risk. When one site is breached, attackers try the same email and password everywhere else, an attack called credential stuffing. No setting on your systems can see a password reused on a shopping site, which is why password managers and breach monitoring matter.
On the exam, if a question asks for the single most effective change to password strength, increasing the minimum length is the safest answer.
Expiration, age and history settings work together, and guidance has shifted
Three settings control when passwords change and whether old ones come back:
- Maximum password age is expiration: the password must change after a set number of days. The default Windows domain policy uses 42.
- Password history remembers previous passwords so they can't be reused. The domain default is 24.
- Minimum password age is how long a user must wait before changing the password again. The domain default is one day.
Minimum age exists to make history work. Without it, a user forced to change a password can change it 25 times in five minutes, push the old one out of the history list and set it again. With a one-day minimum age, cycling through 24 passwords takes 24 days.
Forced periodic expiration is where guidance has shifted. Frequent forced changes push people toward predictable patterns, such as Fall2026 becoming Winter2026, and attackers who know an old password guess the next one easily. NIST's current guidance says not to require periodic changes, and to force a change when there's evidence of compromise, such as a password appearing in a breach list. Many organizations and some compliance frameworks still use expiration; PCI DSS, for example, expects a 90-day change for passwords used as the only factor unless accounts are continuously analyzed for risk.
For the exam, know both views. If a question asks which setting enforces expiration, prevents cycling or blocks reuse, answer with maximum age, minimum age or history. If it asks for the modern recommendation, expect long passwords, breach screening, MFA, and changes driven by evidence of compromise rather than the calendar.