The Password Clock Is Mostly Theater
Password expiration policies have the weary authority of a rule written by someone who has never had to live inside it. They feel busy and protective, like airport signs in a language nobody speaks: lots of motion, little actual defense. What they reliably produce is not security but choreography—forced changes, sticky notes, mutated passwords with a cheerful exclamation point at the end, and a workforce trained to treat safety as a quarterly nuisance.
The strangest thing is that expiration often punishes the decent and the forgetful while barely inconveniencing the truly careless. Humans will dutifully comply with almost any ritual if it is presented as protection. We are less interested in whether a rule works than in whether it can be survived. That is why password expiration endures: not because it is wise, but because it gives the comforting sensation that something has been done.