NIST's current guidance asks for long passwords, not complex ones: at least 15 characters if the password is the only factor, no composition rules, no forced periodic changes, and a blocklist of known bad passwords. Add multi-factor authentication, and store passwords as salted hashes.
What does NIST require now?
The fourth revision of NIST SP 800-63B, the digital identity guideline on authentication, sets out rules for services that verify passwords. Verifiers must require at least 15 characters when the password is the only factor, and may allow a shorter password, with a floor of eight characters, when it is used only as part of multi-factor authentication. They should allow a maximum length of at least 64 characters, accept all printing ASCII characters and the space, and accept Unicode.
Equally important are the things it says not to do. Verifiers must not impose other composition rules, such as requiring mixtures of character types, and must not require users to change passwords periodically. A change is forced only when there is evidence the authenticator has been compromised.
Why did the advice change?
Because forced complexity and rotation produced predictable behaviour. People add an exclamation mark and a digit, then raise the digit at each change. Complexity rules make passwords harder to remember, so people reuse or write them down. NIST notes that highly complex passwords are less memorable and more likely to be stored unsafely.
Length helps more than symbols. A passphrase of several unrelated words is easier to remember and harder to guess than a short mix of characters.
How should you check new passwords?
NIST says passwords chosen by users should be compared against a blocklist of unacceptable values: passwords from previous breach corpuses, dictionary words and context specific words such as the service name. The blocklist does not need to be enormous. Its main job is to stop very common passwords that could be guessed online before rate limiting kicks in.
Pair that with throttling of failed attempts, and with monitoring for sign-in patterns that look like credential stuffing.
How should a service store passwords?
NIST requires passwords to be salted and hashed with a suitable password hashing scheme that has a cost factor, so each guess is expensive for an attacker who steals the hash file. The OWASP Password Storage Cheat Sheet recommends modern, slow algorithms such as Argon2id, with scrypt and bcrypt as alternatives, and explains how to set the work factor. Do not use a fast general purpose hash on its own, and never store passwords in a reversible form.
What should individuals do?
CISA's advice for people is consistent with this. Use long, unique passwords for every account. Use a password manager to create and remember them. Turn on MFA wherever it is offered, with the strongest option available. Do not reuse passwords across work and personal accounts. Change a password at once when you learn it may be exposed, not on a calendar.
For a few accounts that matter most, such as your email and password manager, use a passkey or hardware key if offered.
A constructed example
An internal portal enforces eight characters, one capital, one number, one symbol and a change every 60 days. Help desk logs show about a third of calls are resets. Audit shows many passwords of the form Season plus year plus an exclamation mark. The team switches to a 15 character minimum with passphrases allowed, a breached password check, no rotation, and MFA. Reset calls fall and the audit finds fewer guessable values. Users also stop keeping sticky notes on monitors.
How to check or apply this
- Set the minimum length to 15 for single factor passwords, and no lower than eight with MFA.
- Allow at least 64 characters and paste into password fields.
- Remove composition rules and scheduled expiry.
- Check new passwords against a breached and common password list.
- Rate limit failed attempts per account and per source.
- Hash with Argon2id or another approved scheme and a tuned cost.
- Require MFA for staff, and phishing resistant factors for administrators.
- Give staff a company password manager.
Quick check
Should we still force password changes every 90 days?
NIST says verifiers must not require periodic changes. Force a change only on evidence of compromise.
Is a passphrase better than a complex password?
For most people, yes. Length and uniqueness matter more than symbols, and a passphrase is easier to remember.
Sources
Last reviewed: 18 October 2026.
