A system and method for dynamically adjusting or modifying the password expiration period for a given user based upon how a user accesses the password-protected resource. The tighter the physical control of how a user can access a resource results in a loosening or maintaining of the password expiration period to be a relatively long period of time, whereas the looser the physical control of how a user can access a resource results in a tightening of the password expiration period to be a relatively short period of time. The password expiration period is adjusted based on both actual usage patterns as well as variances in such usage patterns.