NIST password guidelines

The US National Institute of Standards and Technology rewrote the rulebook on passwords. Here's what SP 800-63B actually says, in plain English, and a tool to check your own policy against it.

Do

  • Minimum length 8; 15 if password-onlyShort passwords are the one thing length rules should stop. Longer passphrases are encouraged.
  • Accept at least 64 charactersSo passphrases and password-manager output fit. Don't silently truncate.
  • Allow any printable character, spaces and UnicodeEvery character counts toward length; spaces may be normalised.
  • Screen against breached and common passwordsReject passwords found in breach corpuses, dictionaries, repetitive or sequential strings, and context words like the service name or username.
  • Allow paste and password managersBlocking paste pushes people toward short, typeable passwords.
  • Offer "show password"Lets people check what they typed instead of making it shorter to avoid typos.
  • Rate-limit failed attemptsThe main defence against online guessing, and why modest passwords survive online.
  • Store with a salted, slow hashA memory-hard or iterated key-derivation function with a unique salt per password.

Don't

  • No composition rules"One upper, one lower, one digit, one symbol" produces Password1! and adds little strength.
  • No periodic forced changesChange only on evidence of compromise. Scheduled expiry breeds Spring2025! → Summer2025!.
  • No hints or security questionsAnswers are often findable or guessable.
  • No truncation or maximum below 64Caps like "8–16 characters" reject the strongest passwords.

The old habits here (complexity rules, 90-day expiry) came from earlier guidance. NIST now calls them counterproductive because people satisfy them in predictable ways.

Why NIST changed its advice

Early-2000s guidance leaned on complexity and expiry. Research on real leaked passwords since then showed the result: people meet "one of each character type" with a capital first letter and 1! at the end, and meet "change every 90 days" by incrementing a number. Attackers know both habits and build them into cracking rules.

The current approach moves the burden from users to systems. Instead of making people memorise contorted strings, services must accept long passwords, check them against lists of known-bad ones, limit guessing, and store them properly. Users get to pick long, memorable passphrases and use password managers.

Our tools follow the same logic: the strength checker judges by how guessable a password is, not by which character types it contains, and the breach check is the screening step NIST describes.

What this means for you as a user

  • Use a long passphrase for the few passwords you type yourself.
  • Let a password manager generate and remember the rest.
  • Change a password when a site tells you it was breached, not on a timer.
  • Turn on multi-factor authentication. SP 800-63B treats a password alone as the weakest option.

Loading the policy reviewer…

NIST guidelines FAQ

What are the NIST password guidelines?

They are the password rules in NIST Special Publication 800-63B, "Digital Identity Guidelines: Authentication and Authenticator Management". Revision 4, finalised in 2025, requires a minimum of 8 characters (15 recommended when the password is the only factor), acceptance of at least 64 characters, screening against breached and common passwords, and no composition rules or forced periodic changes.

Does NIST still recommend changing passwords every 90 days?

No. SP 800-63B says verifiers should not require periodic password changes. A change should be forced only when there is evidence the password has been compromised. Scheduled expiry pushes people into predictable patterns like adding 1 to the end.

Does NIST require special characters?

No. It says verifiers should not impose composition rules such as requiring a mix of uppercase, lowercase, digits and symbols. It does require that all printable ASCII characters, the space and Unicode characters be accepted, so users can include them if they want.

What minimum password length does NIST recommend?

At least 8 characters for any password, and at least 15 when the password is used as a single-factor authenticator. Systems must permit passwords of at least 64 characters so passphrases fit.

Are security questions allowed under NIST guidelines?

No. Verifiers should not prompt users to store password hints or use knowledge-based questions like "What was your first pet’s name?", because the answers are often public or guessable.

Who has to follow SP 800-63B?

It is mandatory for US federal agencies’ systems and widely adopted as a baseline by companies, auditors and other standards. Private organisations follow it voluntarily because it reflects current evidence about how passwords fail.