NIST Password Guidelines Explained Simply

The US National Institute of Standards and Technology (NIST) publishes Special Publication 800-63B, Digital Identity Guidelines, which many organizations worldwide use as a reference for password policies. Its recommendations surprised people when they first appeared, because they contradicted years of conventional advice.

Key recommendations

• Length is the priority. The latest revision (800-63B-4) sets a minimum of 15 characters when a password is the only authentication factor, and 8 characters when it is used alongside another factor.
• Allow long passwords. Services should accept passwords of at least 64 characters.
• Allow all characters, including spaces and Unicode, so people can use passphrases.
• No composition rules. Services should not force a mix of uppercase, numbers and symbols.
• No routine expiry. Do not force password changes on a schedule; require a change when there is evidence of compromise.
• Check against breached and common passwords. Reject passwords found in breach lists, dictionary words and obvious patterns.
• No password hints or knowledge-based questions such as "What was your first pet's name?"
• Allow paste, so password managers work properly.

Why expiry was dropped

Forced changes every 90 days led people to make small, predictable edits: "Spring2026!" becomes "Summer2026!". Attackers know this, so frequent expiry made passwords weaker, not stronger.

What it means for you

As a user, the guidance supports a simple approach: long, unique passwords created by a password generator, stored in a password manager, and changed only when there is a reason.

As a site owner, consider updating your sign-up form: raise the minimum length, remove composition rules, allow paste, block known breached passwords and offer two-factor authentication.

Standards evolve, so check the current version of NIST SP 800-63B before setting an organizational policy.

Frequently asked questions

What are the NIST password guidelines in short?

NIST password guidelines say: favor length, allow long passwords and spaces, drop composition rules, block common and breached passwords, and stop forcing scheduled changes. Passwords with spaces should be allowed so people can use passphrases.

What is a good password expiration policy?

Current guidance says not to force routine expiry. A modern password expiration policy requires a change only when there is evidence of compromise, such as a breach. Password expiration on a fixed schedule tends to create weaker passwords.

What is the minimum password length NIST recommends?

The minimum password length in the latest NIST SP 800-63B revision is 15 characters when a password is used alone, or 8 characters when combined with another factor such as 2FA.