Strong passwords are long, unique and checked against known breached lists. NIST's current guidance says to drop forced character mixes and routine expiry, and to add multi-factor authentication. Use a password manager, and change a password only when it may have been exposed.
What does NIST require for password length?
NIST SP 800-63B, in its revision 4 text, sets a minimum of 15 characters for passwords used as the only authentication factor. Passwords used only as part of multi-factor authentication may be shorter, with a minimum of eight characters. The guideline also says systems should accept long passwords, allow spaces, and accept Unicode characters, counting each code point as one character.
The practical message for anyone building a login page is to stop capping length at 16 or 20 characters. Users who pick a passphrase need room for it.
Why drop complexity rules and forced changes?
Two old habits are now explicitly discouraged. Verifiers should not impose composition rules such as requiring a mix of character types, and should not require periodic password changes. The document explains that analyses of breached password databases show composition rules help less than people assumed. Users answer them with predictable patterns, such as a capital letter first and a digit and symbol at the end.
There is one exception for changes. A system must force a change if there is evidence the password has been compromised.
What should you do instead?
Compare new passwords against a blocklist. NIST says the list should include passwords from previous breaches, dictionary words and context specific words such as the name of the service. It also says the list does not need to be huge, since the length requirement already rules out many entries.
Give clear feedback when you reject a password so the user can fix it. And rate limit guessing attempts so an attacker cannot try thousands of passwords against one account.
Where does MFA fit?
A password alone is a single secret that can be phished, reused or leaked. A second factor means a stolen password is not enough on its own. Not all second factors are equal, though. The guideline describes different authenticator types and assurance levels, and some resist phishing better than others. If you are choosing for a team, read the authenticator sections and prefer the types designed to resist phishing for administrators and for access to production systems.
A constructed example
A company enforces eight characters with a symbol and a 90 day change. Employees respond with Summer2026! and then Autumn2026!. An attacker holding last quarter's leaked password guesses the next one in two tries. The company switches to a 15 character minimum, a breach blocklist, no scheduled expiry, and multi-factor authentication. Help desk resets drop, and the guessable pattern disappears, because nobody is forced to invent a new variation every quarter.
How to check or apply this
- Set a minimum length of 15 characters for password only logins, and allow at least 64 characters or more so passphrases fit.
- Remove composition rules and scheduled expiry from your policy.
- Check new passwords against a blocklist of breached and common passwords.
- Force a reset when you find evidence of compromise, and only then.
- Require multi-factor authentication for all staff, starting with administrators.
- Provide a password manager so unique passwords are practical.
- Limit login attempts and alert on bursts of failures.
If your applications hold credentials in code, Safeguard has secrets scanning in its scanners, which catches keys committed to repositories. That is separate from user password policy.
Quick check
Should passwords expire every 90 days?
NIST says verifiers should not require periodic changes. Change a password when there is evidence it was compromised or when the user asks.
Is an eight character password ever acceptable?
NIST allows it only when the password is one part of a multi-factor process. For password only login the minimum is 15 characters.
Sources
Last reviewed: 18 October 2026.
