I also hate password expiration rules. A true manager's "bright idea" which is horrible for security. Once I was registered on a service which required a password change every month, so every single month I had to change a letter or number in my password, because they also stored all my previous passwords and did not let me just swap 2 passwords around, forcing me to create a "new" one every time. BTW my password is 24 characters of solid gibberrish which I can only remember by chanting a long mnemotechnique in my head, obviously never leaking anywhere and unpickable. So changing it is not easy. At some point I was so mad when I could not change a password in a way it did not repeat any of my previous modifications and still remembered easily, so i just put qwerty123 in, needing to log-in into service desperately. It was bruteforced days after.