Current NIST guidance favours long passwords, blocklist checks and no forced periodic changes. It says verifiers must not impose composition rules and must not require people to change passwords on a schedule. Change is required only when there is evidence the password is compromised.
Myth: passwords need symbols, numbers and capitals
Fact. NIST SP 800-63B-4 says verifiers shall not impose other composition rules, such as required mixtures of character types. Length does the work, and arbitrary rules push people toward predictable patterns.
Myth: change passwords every 90 days
Fact. The same section says verifiers shall not require subscribers to change passwords periodically. A forced change is still required if the authenticator is compromised. OWASP repeats this: rotate when a leak is detected, and do not require periodic changes.
Fact: minimum length depends on whether MFA is in play
- A password used alone must be at least 15 characters.
- A password used only as one part of multi-factor authentication needs at least 8 characters.
- Verifiers should allow a maximum length of at least 64 characters.
OWASP cites the same 8 and 15 character figures and adds that you should not silently truncate passwords, and should allow Unicode and spaces.
Fact: check new passwords against a blocklist
NIST says chosen passwords are compared against a blocklist of commonly used, expected or compromised values. The whole password is compared, not substrings. If one is rejected the user must choose another and be told why.
OWASP points to breached password datasets, including the Pwned Passwords service, either through its API or self-hosted.
Fact: store them properly
NIST requires passwords to be salted and hashed with a suitable password hashing scheme. See Argon2id, bcrypt, scrypt and PBKDF2 compared.
A policy you can adopt
- Set minimums by whether MFA is required.
- Allow at least 64 characters and any character.
- Screen against compromised lists at set and change time.
- Drop expiry schedules and composition rules.
- Force a change on evidence of compromise.
- Offer a phishing-resistant option, as covered in which MFA to require.
If an auditor or customer asks, quote the standard and your own policy text. Do not assume a framework requires rotation. Check the control wording you are held to.
A word on communicating the change internally. People are used to being told to rotate passwords, so removing expiry can feel like lowering the bar. Explain that the bar moved to length, screening and MFA. Update the written policy, the onboarding slides and any training quiz at the same time, so staff do not hear two conflicting rules from different places.
Quick check
Does NIST ban password expiry entirely?
It bans requiring periodic change. Changing after a known compromise is still required.
Is 8 characters enough?
Only for a password used inside a multi-factor process. A password on its own needs 15.
Sources
Last reviewed: 19 October 2026.
