This field-guide entry has not been reviewed in its new form yet. The studies are summarized as published; no review date is implied.
Key findings #
NIST SP 800-63B-4 requires passwords used as the only authentication factor to be at least 15 characters long, and at least 8 when the password is used only as part of multi-factor authentication.
Verifiers shall not impose composition rules such as mixing character types, and shall not require periodic password changes, but shall force a change when there is evidence of compromise.
A new password shall be compared in full against a blocklist of commonly used, expected or compromised passwords, and a rejected user shall be told why.
Verifiers shall allow password managers and autofill, should permit paste, and should accept passwords of at least 64 characters.
Evidence #
| Study | Year | Sample | Method | Finding |
|---|---|---|---|---|
| NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator ManagementNIST | 2025 | n/a | Standard | Section 3.1.1.2 sets the password verifier requirements summarized here. |
| SP 800-63B-4 Appendix A: Strength of PasswordsNIST | 2025 | n/a | Informative appendix | Explains why length and blocklists matter more than composition rules. |
What to do #
For engineers #
- Set the minimum by how the password is used: 15 characters where it is the only factor, 8 only where a second factor is always required.
- Accept long passwords and verify them in full; the essay on long password support covers hashing limits and denial-of-service concerns.
- Replace composition rules with a blocklist check against breached and common passwords. The field-guide entry on stolen credentials covers privacy-preserving breach checks.
- Make forms work with password managers: the right
autocompletevalues and no paste blocking. See password-manager friendly login forms.
For product and UX #
- Explain a rejection in plain words (“this password appears in known breaches”) instead of listing rules after the fact. NIST requires a reason.
- Drop scheduled password expiry. Forced changes are for evidence of compromise, which makes them rarer and easier to explain.
- My 2023 password policy essay recommended at least 12 characters. For passwords used on their own, the final SP 800-63B-4 now sets 15.
Check your policy #
Compare a policy with SP 800-63B-4
The checker on this page compares the settings of a password policy with the requirements below. Without JavaScript, use the list as a checklist. “Shall” is a requirement, “should” a recommendation.
- Shall: at least 15 characters for single-factor passwords; at least 8 if the password is only one factor of MFA.
- Should: accept at least 64 characters, all printing ASCII characters, the space character and Unicode; count each Unicode code point as one character.
- Shall not: impose composition rules, such as requiring digits, symbols or mixed case.
- Shall not: require periodic password changes. Shall: force a change when there is evidence of compromise.
- Shall not: offer password hints to unauthenticated users, or prompt for security questions when a password is chosen.
- Shall: verify the whole password, never a truncated or partial one.
- Shall: check new passwords against a blocklist, and tell the user why a password was rejected.
- Shall: rate-limit failed authentication attempts.
- Shall: allow password managers and autofill. Should: allow paste and offer to show the password.
- Shall: store passwords salted and hashed with a suitable password hashing scheme, with a salt of at least 32 bits.