What is suggested as the leading practice for the maximum length of time before users are forced to change their passwords?

90 days is a common best practice recommendation for forced password changes, balancing security and usability. 60 days may be too frequent, leading to password fatigue. 120 and 180 days are considered too long by modern standards, increasing exposure if passwords are compromised. Note that some guidance has shifted toward longer intervals with strong password policies and breach detection.