I agree the title that it's bad as well. It eventually creates password fatigue and users are less likely to expend mental effort picking good passwords if they

I agree the title that it's bad as well. It eventually creates password fatigue and users are less likely to expend mental effort picking good passwords if they know those passwords are going to be thrown away in 90 days. Really the only thing I recommend anymore is a good password managers. Use one very strong password, perhaps changed every 2-3 years if you feel the need, to unlock one or more secure private keys with which all your passwords have been encrypted. The great thing about good password managers that use asymmetric cryptography is that my password is not really the weakest link. If you have access to my hardware, then guessing my password will potentially help you, but otherwise you'll have to break my pgp key (assuming you can also get access to the encrypted password store). At that point I don't really care what your rotation policy is. I can generate a new password every 90 days with no real fatigue.