Password Age & Rotation Checker
Calculate how old a password is from its last change date and when it expires under a maximum-age policy, with expired and due-soon warnings.
0 = the password never expires
Pick the date the password was last changed.
Dates are calendar dates, so time zones and daylight saving time do not shift the result. NIST SP 800-63B advises against forced periodic changes: change a password when there is evidence it was compromised. Use this tool where a policy or regulation still requires rotation.
What is Password Age & Rotation Checker?
Enter the date a password was last changed and the maximum password age from your policy. The tool shows the password's age in days and in years, months and days, its expiry date, the days left and whether it is expired or due soon.
How to use Password Age & Rotation Checker
- Pick the date in Password last changed on.
- Leave Check as of at today or choose another date.
- Set the Maximum password age (days); 0 means it never expires.
- Set Warn this many days before expiry and read the status.
Example
Last changed 2024-01-15, check as of 2024-04-10, maximum age 90 days, warn 14 days
Expires soon: 4 day(s) left. Age 86 days (0 y, 2 m, 26 d), expires on 2024-04-14
When to use Password Age & Rotation Checker
Use it where a policy or regulation still requires periodic rotation, or to audit service accounts. Note that NIST SP 800-63B advises against forced periodic changes for user passwords and recommends changing them on evidence of compromise instead.
How Password Age & Rotation Checker works
Dates are treated as calendar dates in UTC, so time zones and daylight-saving changes cannot shift the result. Age in days is the difference between the two dates; the years/months/days breakdown follows the same rules as java.time.Period. Expiry date = change date + maximum age; the status is expired when no days are left and due soon within the warning period.
Common Use Cases
- Checking when a service-account password must be rotated
- Auditing passwords against a 90-day policy
- Answering 'how old is this password?' for an incident report
- Planning rotation of shared administrator credentials
FAQs
Should passwords expire every 90 days?
Current NIST guidance says no for user passwords: forced rotation leads to predictable patterns. Change passwords when they are compromised. Some regulations and service accounts still require rotation.
Does the time zone matter?
No. Both dates are calendar dates, so the result is the same everywhere.
What does 0 maximum age mean?
The password never expires; the tool then only shows its age.