You’re supposed to have controls in place to prevent all of those concerns. I’m not saying passwords should be changed every 30 days, but 6 months is a long time.

But, companies with password expirations should be providing a password manager.