Does the salesforce password ever expire? Any guides or documentation on the password policy? I know there it is explicitly possible to reset password, but is there any implicit expiry possibility?
Yes, you can set a variety of parameters for your org’s password policy. In Classic or Lightning Setup, search for “Password Policies” in the quick find. The page is pretty self-explanatory - set expiration period, complexity rules, and retained passwords that cannot be reused.
More details are in this Help article: https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/admin_password.htm
As already mentioned by Thomas, you can specify various password expiration policies that apply to the entire org, but you can also exempt certain users from this policy by setting the Password Never Expires option on their profile or via a Permission Set. This allows you to have more control over password policies for normal users versus admins.
As far as general advice goes, various people will give you different opinions about it, but they're all simply guidelines. Choose a balanced approach, and you should be okay. Specifying complexity and length requirements, expiry times, two factor authentication, and an account lockout period is probably excessive, and is more likely to inconvenience a user than it is to stop an actual hacking attempt. Remember, the goal of security is to be safe enough to keep hackers out, but not so secure that your users never adopt the platform to begin with.
Consider requesting/enforcing two-factor authentication with no complexity or length requirements and a modest user lock out period, or perhaps simply using Lightning Login, which requires that they simply verify the login request from their phone for their registered devices. They'll still need to use their username and password from unrecognized devices as they do today, but they'll basically be able to "set it and forget it." Unauthorized users that obtain their username and password still won't be able to log in, because they'll have to verify the login within the timeout window on their mobile device.
Given the variety of newer technologies that are available, forcing users to have complicated, forgettable passwords, and lost productivity because they can't log in should be a thing of the past. Of course, you can still protect part of your org behind a "high assurance only" policy, meaning that super-secret information can only be accessed if they log in with a username, password, and Salesforce Authenticator approval.