Wondering when your login stops working? The password expiry date calculator adds your policy length to the day you last set a password, so you instantly see the exact date your password expires, how many days are left and whether you should change it now. It takes two numbers and a calendar date, and it saves you from an unexpected account lockout in the middle of a busy week.
How the password expiry date calculator works
A password has no fixed expiry stamped on it. As Microsoft's own Q&A community puts it, expiry is simply the last change plus the policy that applies to the account. The calculator mirrors that logic: enter the set date, enter the expiry policy in days, and read the result. Whether you call it a password expiration date calculator, a password expiry calculator or an expiration date calculator, the idea is to track password validity against a set deadline. The same three outputs appear every time: the expiration date, the time left and a status of valid, expiring soon or expired. The bulk password strength auditor checks your input against current best practices and flags anything worth fixing.
Calculate the expiry date from the last password change date
To calculate the date by hand, take the last password change date and count forward by the number of days in your policy, carrying over month ends as you go. Your result is the final day the password still works; the next sign in forces a reset.
$$\text{Expiry date} = \text{Set date} + \text{Policy length (days)}$$Keep three inputs ready before you start:
- Password set date: the day you chose or last changed the password.
- Policy length: the maximum password age your organization sets, in days.
- Today's date: used to work out the days remaining.
The formula is easy to run by hand, but a tool avoids month-length slips, and the shelf life percentage is calculated from the very same two dates.
Password shelf life and percentage remaining
Think of every password as having a shelf life. Dividing the days left by the total shelf life gives the percentage still available, a quick signal for when a change is due:
$$\text{Shelf life remaining} = \frac{\text{Days remaining}}{\text{Total days}} \times 100$$Many people treat 25 percent of the shelf life as the point to act, which leaves time to set reminders and avoid a lockout. The shorter the policy, the faster that percentage drops, so a 30-60 days admin policy needs earlier attention than a long one.
Password expiration date example with a 75-day expiry policy
Say you set a new password on 14 February 2026 and your organization applies a 75-day expiry policy. Count 14 days to the end of February, 31 days through March and 30 days through April, which reaches Thursday, 30 April 2026. That is your password expiration date. Use the free keyboard walk detector to confirm everything looks correct before you rely on it elsewhere.
Now check the status on 9 April 2026:
- Days elapsed since the set date: 54 days.
- Days remaining: 75 − 54 = 21 days.
- Shelf life remaining: 21 ÷ 75 × 100 = 28 percent, so the password has used 72 percent of its life.
- A 14 days reminder lands on 16 April 2026, which is when you should change it.
Time left, days remaining and expiry status
The status reading follows from those numbers. A password with more than 14 days left is valid, one with 14 days or fewer is expiring soon, and zero days means it has expired. In the example above the status is valid today but will flip to expiring soon within a week.
Because the calculation runs in your browser, the dates you enter are not stored or shared, so you can safely test real set dates.
Finding the password expiry report in Microsoft 365 and Active Directory
Administrators rarely have a single set date to check; they need a password expiry report for many users at once. Microsoft 365 has no direct field showing the expiry date, so you work it out from two values: the last password change and the domain policy.
Microsoft 365 admin center and org settings
In the Microsoft 365 admin center, open Org settings and choose the password expiration policy to see the number of days configured. Then open the user in the Microsoft Entra admin center, where the Properties tab shows the last password change date. Add the two together, exactly as the calculator does. You need Global Admin or Security Admin rights for both steps.
PowerShell and fine grained policies
For many users at once, a PowerShell script reads the last changed date and adds the policy days to every account in the domain. In Active Directory there is a catch: fine grained policies can give a group a different maximum age, so a script using only the default domain policy may report the wrong date for those users. Check which policy applies before you trust the output.
Typical password expiration policy lengths
Most organizations pick a length based on account type. These are the common ranges you can type into the calculator:
- Corporate accounts: 90 days is the typical policy, with a 14 days reminder.
- Admin accounts: 30-60 days, with complex passwords required.
- Service accounts: often set to never expire, with a manual annual rotation instead.
Staying past the deadline is a security risk, because a stale credential is easier to abuse. Whatever the policy, the compliance goal is the same: no password stays in use longer than the rules allow, and no user is surprised by a lockout.
Checking an 84-day expiry policy before a Monday lockout
Priya Nandakumar, a help desk lead, notices three accounts in her team's queue showing sign in errors on a quiet Monday, 12 January 2026. She opens the expiry calculator to confirm the cause. The Entra admin center shows a last password change of 3 November 2025, and the Org settings page shows that her department sits on a fine grained policy of 84 days rather than the 90 days the rest of the tenant uses.
She enters 3 November 2025 as the set date and 84 as the policy. The calculator returns Monday, 26 January 2026 as the expiry date. Today is day 70 of 84, which leaves 14 days remaining and a shelf life remaining of 17 percent, below the 25 percent threshold her team uses for outreach.
So this is not the cause of the lockouts, because the accounts are still valid. But the percentage tells her something else: every account in that group will expire within the same fortnight. Her next action is specific: she schedules a reminder email for Wednesday, 14 January and keeps a short list of the 11 users who still need a password change before 26 January. A second run with the 90-day tenant default would have given 1 February and hidden the problem, which is why she checks the policy first.
Shelf life of a password: expiry date vs best before date
The same date arithmetic is used in a very different place. A pharmacy, food manufacturer or warehouse takes a manufacture date, adds a shelf life in months and gets the expiry date; it is why password policies borrow the word shelf life. A best before date is advice, an expiry date is a hard stop, and a beyond-use date is a shorter limit set when a product is repackaged. A password policy behaves like the hard stop.
Treat your accounts the way a warehouse treats stock: sort every batch of passwords by soonest expiry, so the earliest set date plus policy gets changed first, just as stock rotation ships the earliest expiry first. A manufacturer keeps a storage record of dates for quality control of access and security, and your password expiry date calculator needs the same set date record to give a reliable answer.
Converting a policy in months to days
Some policies are written in months rather than days, such as 3 months or 6 months. Convert the policy to a date by adding the months to the set date rather than multiplying by 30, because months have different lengths. A password set on 31 January with a policy of 1 month lands on the last day of February, so check the result instead of assuming. When the policy is in months, the total days of shelf life change slightly each cycle, and the percentage remaining changes with it. Policies of 3, 6 or 12 months are common for service accounts, while 12 months suits a manual annual rotation.
The password version of a manufacture date sum is the same: enter the set date, add the months-based policy and read the expiry date. A pharmacy would then reject any batch whose shelf life is mostly used, and you should treat a password with under 25 percent of its shelf life left the same way, then handle the soonest expiry first.
Password expired: reset password, account lockout and best practices
When a password expired notice appears, the account is locked until you reset it. A password reset is the usual fix. You are prompted to change password at the next login, and you must enter the old password and then a new password that meets the rules. If the self-service reset is not set up for your organization, you must contact IT.
Avoid the situation with a few habits:
- Use a strong password of 12 or more characters, complex enough that a new expiry date is not a reason to pick a weaker one.
- Store it in a password manager rather than writing it down.
- Never reuse an old password, and replace stale passwords on schedule.
- Enable 2FA so an account stays protected if you miss the expiry date.
- Set reminders 14 days before expiry and change regularly.
A calculator cannot read your directory, so its answer is only as good as the set date and policy you give it. Use it as a quick check, then confirm the real policy with your administrator.
Frequently Asked Questions
- Is forced password rotation still recommended?
- Not by current NIST guidance (SP 800-63B) for user-chosen passwords -- research found that forced periodic rotation tends to push people toward small, predictable variations of their previous password rather than genuinely new ones, which can make passwords easier to guess rather than harder. Rotation is still commonly required by specific compliance frameworks (PCI DSS, some corporate policies) or after a suspected compromise, which is why this calculator exists as a scheduling aid.
- How is the expiry date calculated?
- It's simply the last-changed date plus your chosen rotation period in days -- e.g. a password last changed on January 1st with a 90-day rotation policy expires on April 1st (approximately; the calculation is exact to the day using standard date arithmetic).
- What if my organization's policy isn't 90, 180, or 365 days?
- Use the Custom option to enter any rotation period in days -- some organizations use unusual periods (like 60 or 45 days) for higher-sensitivity accounts.
- Does this tool track my password's actual expiry for me?
- No -- it's a one-time calculation based on the date you enter, not a running reminder system. Note the resulting date yourself, or set a calendar reminder, since this page doesn't store anything between visits.
- Is my data sent anywhere?
- No. The calculation happens entirely in your browser using standard JavaScript date arithmetic -- nothing is transmitted to a server or stored (and no actual password is ever entered into this tool, only a date).