What is suggested as the leading practice for the maximum length of time before users are forced to change their passwords?

Security best practices historically recommended 90-day password rotation to limit the window of potential compromise if credentials are exposed. This interval balances security needs with usability concerns. While modern guidance has evolved, 90 days remains the commonly cited leading practice period in many security frameworks.