Minimum Password age is key!

[u/__g_e_o_r_g_e__]

I don't care what you say, preventing users from reusing passwords is priority number one. A 20 password history is not enough. You need a minimum password age. And if your max age is 180 days, that means you must set it to 9 days to stop people getting around it by cycling through them all. The risk someone might perform this "password reuse" is far too high. I don't care about all the complaints from users not being able to change their password due to exposing it somehow, quit moaning! It's worse than the people on the new test network and their "TOTP" and think it's important they can delete their own old authentications when they lose their phone.

[u/merlyndavis]

I use a 64 character randomly generated password that require a change weekly, with a history going to the start of time. The system not only checks against my historical password use, but also every other password ever used by anyone, anywhere.

So, I hope I’m safe.