What do password policies regulate, and how has current NIST guidance changed what a good policy looks like?
Password policies set rules for length, complexity, character mix, expiry and reuse, and so determine the strength of the memorized secret; current NIST guidance keeps length and blocklists but drops composition rules and forced periodic changes.
Traditional policies demanded "at least 8 characters with upper and lower case, a digit and a special character, changed every 90 days". Research showed that this produces predictable patterns (Summer2024! becomes Autumn2024!) and pushes users to write passwords down.
NIST SP 800-63B-4 (2025) therefore requires:
| Rule | Current NIST guidance |
|---|---|
| Minimum length | 15 characters if the password is the only factor; at least 8 if it is used only within MFA |
| Maximum length | Allow at least 64 characters; accept spaces and Unicode |
| Composition rules (character mix) | Must not be imposed |
| Periodic expiry | Must not be required; force a change only on evidence of compromise |
| Blocklist | Must reject common, expected and breached passwords |
| Hints and security questions | Must not be used |
| Password managers and paste | Must be allowed |
| Failed attempts | Must be rate-limited |
The underlying idea: length and unpredictability make a password strong, and a blocklist removes the guessable ones. Rules that only change its appearance do not.
Go deeper:
NIST SP 800-63B-4: Password verifiers — the normative rules on length, composition, expiry and blocklists.- NIST SP 800-63B-4: Strength of passwords — the rationale for length over complexity.
- Netwrix: NIST password guidelines explained — a practitioner summary of the guidelines.