TechCompare LogoTechCompare

NIST password guidelines: what the US government actually recommends for passwords

NIST's guidelines are the gold standard for password policy. Length over complexity. No forced rotation. Block known compromised passwords. Allow paste. These rules make passwords both more secure and less annoying for users.

NIST Special Publication 800-63B-4 is the US government's current guidance on digital identity, including password policy. It explicitly recommends against many of the rules you've been told your whole life: no mandatory character mixing (uppercase + lowercase + number + symbol), no periodic password changes, no password hints, and no knowledge-based authentication (mother's maiden name, first pet). The old rules made passwords weaker, not stronger.

By TechCompare · Updated

Security domain
Standards
Official guidelines and compliance
Topic focus
NIST guidelines
nist-guidelines
Try the live Password Generator. Generate a passphrase or random string with custom rules.
Edit in the full tool

How this is calculated

NIST's current verifier requirements are at least 15 characters for a password used as a single authentication factor, or at least 8 when the password is only one factor in MFA. There are no composition rules (must include uppercase, number, etc.) because they lead to predictable patterns (Password1!). No periodic password changes are required unless there's evidence of compromise, because forced rotation leads to weaker passwords (Password1!, Password2!, Password3!). Screen new passwords against a list of commonly compromised passwords. Allow paste in password fields (disabling paste encourages shorter, weaker passwords). Support Unicode (emoji in passwords is valid). Allow a maximum input length of at least 64 characters. These requirements come from the 2025 revision, SP 800-63B-4.

Verdict

SP 800-63B-4 keeps the useful rejection of old password rules. Mandatory composition rules push users toward Password1!, and forced 90-day rotation produces Password1, Password2, Password3. The current verifier requirements are 15 characters minimum for single-factor passwords and 8 when the password is only one factor in MFA, plus screening against known compromised lists, paste support, a maximum input length of at least 64 characters, and Unicode support including emoji. Organizations still enforcing old rotation and composition rules are not following the current NIST guidance.

More Passwords scenarios

Password length guide
Password length is the single most important factor in password strength.
View details ➜
Passphrase vs password
A password is a short string of mixed character types (like Kx9$mQ2!pR).
View details ➜
Password manager guide
A password manager is a single encrypted vault that generates, stores, and autofills strong unique passwords for every account you have.
View details ➜

Related guides

Password length guide
NIST's length-first recommendation in practice.
View guide ➜
Password entropy
Entropy as a mathematical measure of NIST's password strength.
View guide ➜

Frequently asked questions

What does NIST actually recommend for passwords?
SP 800-63B-4 requires at least 15 characters for a password used as a single authentication factor, or at least 8 when the password is only one factor in MFA. It also calls for screening against known-compromised strings, allowing paste, supporting at least 64 characters and Unicode, and avoiding forced periodic changes and composition rules.
Why does NIST say not to force password changes every 90 days?
Because measurable harm follows. Users facing mandatory rotation produce Password1!, Password2!, Password3! - predictable increments that attackers guess in seconds. NIST's current position is to rotate only when there's evidence of compromise, and to spend the effort on breach screening and MFA instead.
Are complexity rules (uppercase, number, symbol) still recommended?
No. NIST dropped composition rules because they manufacture predictable patterns rather than entropy: most people capitalize the first letter and stick the digit at the end, which is the first shape cracking dictionaries try. Length and breached-password screening deliver the security that the old complexity requirements only pretended to.

Related tools

CHMOD Configurator

Calculate Linux file permissions using checkboxes or octal numbers, then view the matching symbolic notation.

Use tool ➜

Text Encoding Converter

Convert between Text, Base64, Binary, Hexadecimal, and Decimal formats.

Use tool ➜

Cron Generator

Visually build standard 5-part cron expressions or translate them into readable schedules.

Use tool ➜