Both. Password management is more complicated than that - and it inevitably suffers from being distilled down to what the end user can understand. Password length is usually set to a period and length that exceeds the time a given computer can brute force the password. In other words - if a reasonable adversary can crack the password on a fast PC in 30 days, then either the password needs to be longer, or you need to change it sooner. Of course - explaining this to people can be complicated - and enforcing complex rules for passwords like, if it's 8 characters it needs to be changed every 10 days, and if it's 9 characters then every 30 are also not possible on most systems. So people try to generalize. If you explain to them for example that you have 15 character passwords, and cracking them brute force is just not practical - you have processes to change them when key people who know the password leave, (or if the crypto were to be broken), then perhaps you could have your approach risk accepted. In practice this will probably save you a lot of effort - and you will end up with better passwords as well. Hope that helps.