Answer password questions by stating what your product and your staff policy actually enforce: minimum length, a blocklist check, no forced periodic change, and MFA. NIST SP 800-63B-4 supports those choices. Reviewers still using old rules, such as 90 day rotation and mixed character classes, may need a short explanation with a citation.
What NIST SP 800-63B-4 says
The current revision of NIST's digital identity guidance sets these expectations for services that verify passwords (section 3.1.1.2):
- Passwords used alone as a single factor must be at least 15 characters. Passwords used only as part of multi-factor authentication may be shorter, with a floor of eight.
- Services should permit a maximum length of at least 64 characters.
- Services must not impose other composition rules, such as mixing character types.
- Services must not require periodic password changes, but must force a change if there is evidence of compromise.
- Services must compare new passwords against a blocklist of common, expected or compromised values. The whole password is compared, not substrings.
- Services must allow password managers and autofill, and should permit paste.
- Services should accept Unicode, counting each code point as one character.
These are quoted in outline. Read the document itself before you cite section numbers in a contract.
Two questions, two answers
Buyers usually mean two things, and they need separate answers.
Your product's password rules for customers. Describe what your login enforces, for example length minimum, blocklist screening and MFA availability. If you hash passwords, say which algorithm in one line.
Your internal policy for staff. Describe your identity provider setup, MFA enforcement, and password manager use. Say whether you use SSO for internal apps.
Mapping old questions to better answers
| Questionnaire line | Honest answer pattern |
|---|---|
| Passwords rotated every 90 days? | We do not force periodic rotation, following NIST SP 800-63B-4. We force a reset on suspected compromise. |
| Requires uppercase, number, symbol? | We enforce length and blocklist checks instead of character classes, which NIST advises against. |
| Minimum 8 characters? | State your real minimum. If it is below 15 for single factor accounts, say MFA is required or plan to raise it. |
| Passwords stored encrypted? | Passwords should be hashed with a slow, salted algorithm, not encrypted. Say which one. |
If a buyer's policy mandates rotation, you can comply for their tenant if they ask, but note that you recommend against it.
Steps to check your own login
- Test a short password. Does the form reject it?
- Try a known breached password. Does the blocklist catch it?
- Paste a long passphrase from a password manager. Does it work?
- Try 64 characters. Does it accept them?
- Look for any forced expiry date and remove it unless there is a reason.
Try it yourself
Click through it at your own pace, or open it full screen. It shows how a policy can be enforced as a check on every change, rather than relied on as a document.
Safeguard's SBOM and dependency scanning can flag vulnerable authentication libraries in your code, and you can try the free scan on a repository.
Quick check
Is a 90 day password rotation still recommended?
NIST SP 800-63B-4 says services must not require periodic changes, only a change when compromise is suspected.
Should we still require special characters?
NIST says services must not impose other composition rules. Use length and blocklist checks instead.
Sources
- NIST, SP 800-63B-4, Authentication and Authenticator Management, section 3.1.1. Paraphrased.
Last reviewed: 19 October 2026.
