Tip: Some systems only remember your last 3 or 10 passwords, so it's worth rotating up to Password9 and then coming back to Password0. Tip given by my boss who received it by his chain of command of old people who couldn't remember the password change. True story.

I'm not sure that it makes much difference whether I reset to 0 or keep going through 10 and up. My biggest frustration is that every password change I'll mistype my closing digit for about a week before muscle memory gets the new one right,

(Although this time I had a unique experience where I adjusted quite quickly from "2" to "3" and because I was still thinking "don't forget to incrememnt" ended up typing "4". Uggggghhhhhhhhhh)

... and then you get locked out because your domain controller (or whatever) is set up to ban you after ~3 invalid login attempts in a row. Happened to me once.

Which is why in a lot of corporate systems, the password history is set to 13 last passwords. a) it prevents a 0-9 rotation, and b) it also prevents people rolling passwords based on month name or number.

August2016 September2016 October2016 etc.

pls don't hack me

I didn't say it was a good system ;)

As the implementer, I've argued many times about it, but the ITSec bods always think they know best.

Do they put a maximum on how many times you can change your password? If not, you could just cycle through 13 passwords in 5 minutes, then switch back to your original password.

I wrote a PowerShell script that does exactly this for Windows Domains.

http://pastebin.com/raw/ytwy0nCB

In AD there is a MinPasswordAge policy that is typically set to 1 day to thwart exactly this type of work-around.

That's what hexadecimal digits are for :)

Why is why password rolling is then based on an alphabetical roll, or pure numerical increment, or month and year. No real entropy gain!

Fun fact. In my organization we are required to change password each three months, so now im on ...24 and i can calculate from that how long i been working here :)

Instead of numbers, you can also use spring-summer-autumn-winter.

This is what I used to do before I started using a password manager. Now I just change my password to a new, randomly generated one every month while my master password stays the same.

Sure, but this method doesn't work when I need to login to my corporate PC at work.

It does for me. KeePass on my phone + InputStick. I've even got a macro set up to enter all the necessary keystrokes so I can login with one tap. (Ctrl+Alt+Del -> Enter Password -> Enter)

Thank you for introducing me to InputStick!

You're welcome. I discovered it myself only around 6 months ago, and so far I've found it to be very useful.

Their website lists a lot of different potential applications, but I use it almost exclusively for entering passwords from KeePass. In addition to allowing password entry on the computer's lock screen, it also saves me the trouble of having to read and retype passwords manually on computers that don't have KeePass installed, and avoids exposing my entire password database to the computer it's plugged into (as would be the case if I used portable KeePass on a USB memory stick).

This is exactly what I do as well. Well, when I'm not getting the AD admins to let me reset my password directly from the admin console.