> removing the requirement to change passwords every 90 days would encourage very few people to select secure passwords

When you don’t require them to change it, you can just assign them a random 16 character string and tell them it’s their job to memorize it.

There's no way I will ever remember it. I will write it down. Let me choose my own password (passphrase if I need to remember it)