NIST revised its recommendations about forced passwords after finding users were changing their passwords by just one character to ensure they could still remember them – for example, “hospital001” to “hospital002”. This was considered to be an unsafe practice because, if the original password had been compromised, there was a strong likelihood the new one would be as well.