Some possibilities off the top of my head (some suggested here already): * Test for password strength (most reused passwords are weak) * Test for password exi

Some possibilities off the top of my head (some suggested here already): * Test for password strength (most reused passwords are weak) * Test for password existence in public databases (and recheck on database updates when they log in) * Automatically generate a secure password for your users at the account creation stage and require them to use it * Use a login method more sophisticated than just username / password to mitigate against password reuse * Expire the first password they enter instantaneously, but then never expire again. * Set an exact length requirement of between 16 and 20 characters inclusive. (Don't actually do this, but it's better than password expiry.) * If your users are also your employees, make them responsible if their password is compromised while training them in proper password use. I don't know, it just seems to me like basically any solution, including doing nothing, is better than expiring passwords. Even if it forces a few people to not reuse a password and there were no other way to achieve the same result, the tradeoff of worse security that results would make it not worth it.