NIST password guidelines: what the US government actually recommends for passwords

NIST's guidelines are the gold standard for password policy. Length over complexity. No forced rotation. Block known compromised passwords. Allow paste. These rules make passwords both more secure and less annoying for users.

NIST Special Publication 800-63B is the US government's official guidance on digital identity, including password policy. It explicitly recommends against many of the rules you've been told your whole life: no mandatory character mixing (uppercase + lowercase + number + symbol), no periodic password changes, no password hints, and no knowledge-based authentication (mother's maiden name, first pet). The old rules made passwords weaker, not stronger.

By TechCompare · Updated August 2026

Security domain

Standards

Official guidelines and compliance

Topic focus

NIST guidelines

nist-guidelines

How this is calculated

NIST's key recommendations: minimum 8 characters for user-chosen passwords, 6 for machine-generated. No composition rules (must include uppercase, number, etc.) because they lead to predictable patterns (Password1!). No periodic password changes unless there's evidence of compromise, because forced rotation leads to weaker passwords (Password1!, Password2!, Password3!). Screen new passwords against a list of commonly compromised passwords. Allow paste in password fields (disabling paste encourages shorter, weaker passwords). Support Unicode (emoji in passwords is valid). Allow at least 64 characters maximum length. These guidelines were published in 2017 and updated in 2024. Organizations that still enforce 90-day rotation and complexity rules are following outdated guidance that NIST itself repudiated.

Verdict

SP 800-63B flipped the old advice on purpose. Mandatory composition rules push users toward Password1!, forced 90-day rotation produces Password1, Password2, Password3, and both make passwords weaker. The spec calls for 8 characters minimum (6 for machine-generated), screening against known compromised lists, paste enabled in fields, 64-character maximums, and Unicode support including emoji. Organizations still enforcing the old rules follow guidance NIST itself repudiated.