It prevents users from memorising their passwords, and prompts them to create simpler, easier to remember passwords. Moreover, it also introduces unnecessary risk when users are forced to change their passwords, potentially leading to weaker passwords being chosen and opens up opportunities for phishing attacks. Some people think that a secure password is enough and that it’ll ensure their security, but passwords should only ever be used alongside another form of authentication.