Modern Password Rules: What NIST Actually Says Now

The rules changed — most policies haven't caught up

If a system has ever forced you to include "one uppercase, one number, one symbol" and change it all every 90 days, here's the surprise: the U.S. standards body that defines good authentication practice now says don't do any of that.

The authority here is NIST Special Publication 800-63B, Revision 4 (finalized 2025) — the U.S. government's digital identity guidelines, which much of the industry follows. Its password section reads like an apology for two decades of bad advice. Here's what it actually says, and what it means for you.

Rule 1: Length is the requirement, and it went up

NIST's hard requirements (their SHALL language):

• A password used on its own (single-factor login): minimum 15 characters.
• A password used alongside multi-factor authentication: may be shorter, but minimum 8 characters.
• Systems must support long passwords — at least 64 characters allowed.

The 15-character single-factor minimum is the headline change — it's a hard requirement now, not a suggestion. The reasoning: length does more against modern cracking than any symbol requirement, and long passphrases ("correct-horse-battery-staple" style) are both stronger and easier to remember than "P@ssw0rd!".

Rule 2: Complexity rules are banned, not just discouraged

NIST's words: verifiers "SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types)."

Why ban them? Because decades of data show what humans do under complexity rules: Password1! — technically compliant, practically guessable. Complexity requirements made passwords harder for people and barely harder for machines.

Rule 3: Forced periodic resets are also banned

Verifiers "SHALL NOT require subscribers to change passwords periodically." The one exception: a forced change when there's evidence of compromise — that part is required.

The logic: forced 90-day rotations push people into predictable patterns (Summer2025! → Autumn2025!) and encourage writing passwords down. Change passwords when there's a reason, not on a calendar.

Rule 4: Blocklists replace complexity theater

Instead of symbol rules, systems SHALL check new passwords against a blocklist of known common, expected, or previously-breached passwords. hunter2 fails not because it lacks an uppercase letter but because it's on every cracking list on the internet.

For you personally, the same idea: if a password has ever appeared in a breach (haveibeenpwned.com will tell you), retire it everywhere.

Rule 5: Password managers are officially endorsed

Verifiers "SHALL allow the use of password managers and autofill" and should permit pasting into password fields. Sites that block paste in password boxes are now directly contradicting the standard.

This settles the practical question. The modern setup NIST's rules point to:

1. A password manager generating long random passwords — unique per site.
2. Multi-factor authentication everywhere it's offered (which also legitimately relaxes the length burden per Rule 1).
3. One strong memorized passphrase (15+ characters) protecting the manager itself.

If you build or administer systems

• Minimum 8 with MFA / 15 without; support up to at least 64.
• No composition rules. No periodic expiration. Forced reset on evidence of compromise.
• Blocklist check on set/change. Allow paste and password managers.
• These map directly to Authentication Failures (A07) in the OWASP Top 10 — outdated password policy is a listed security risk, not just annoying UX.

Check your understanding

1. Under Rev 4, when is an 8-character password acceptable?
2. Why did NIST ban complexity requirements rather than just discourage them?
3. What's the one situation where a forced password change is required?

Key takeaways

• Current standard: 15+ characters single-factor, 8+ with MFA, support to 64 — length over complexity.
• Composition rules and calendar-based forced resets are prohibited; breach-triggered resets are mandatory.
• Blocklists, password managers, and paste support are part of the standard.
• Personal strategy: manager + unique long passwords + MFA + one strong master passphrase.

Sources

• NIST SP 800-63B, Revision 4 — pages.nist.gov/800-63-4 (primary source; SHALL/SHALL NOT requirements quoted and verified July 2026)