---
author: Jan Brennenstuhl
canonical_url: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/
description: What NIST SP 800-63B-4 requires from a password policy, and a checker that compares your own policy against it.
id: jb-guide-password-policy-requirements
kind: guide
license:
  name: CC BY 4.0
  scope: Original text; credited third-party media retain their own rights.
  url: https://creativecommons.org/licenses/by/4.0/
markdown_url: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/index.md
modified: '2026-10-13T00:00:00+02:00'
published: '2026-10-13T00:00:00+02:00'
review_basis: ''
review_status: not-reviewed
reviewed: ''
series: ''
status: published
title: What should a password policy require?
topics:
- passwords
---

# What should a password policy require?

**Short answer:** Under NIST SP 800-63B-4, a password used on its own must have at least 15 characters, or 8 when it is one factor of multi-factor authentication, and systems should accept at least 64. Composition rules, forced periodic changes, hints and security questions are out; a blocklist of common and breached passwords is in.


<a id="key-findings"></a>
## Key findings


<a id="f-nist-min-length-15"></a>
> **Finding f-nist-min-length-15:** NIST SP 800-63B-4 requires passwords used as the only authentication factor to be at least 15 characters long, and at least 8 when the password is used only as part of multi-factor authentication.
>
> Source: [NIST SP 800-63B-4, Section 3.1.1.2](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/)
> Link: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/#f-nist-min-length-15



<a id="f-nist-no-composition-no-rotation"></a>
> **Finding f-nist-no-composition-no-rotation:** Verifiers shall not impose composition rules such as mixing character types, and shall not require periodic password changes, but shall force a change when there is evidence of compromise.
>
> Source: [NIST SP 800-63B-4, Section 3.1.1.2](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/)
> Link: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/#f-nist-no-composition-no-rotation



<a id="f-nist-blocklist-with-reason"></a>
> **Finding f-nist-blocklist-with-reason:** A new password shall be compared in full against a blocklist of commonly used, expected or compromised passwords, and a rejected user shall be told why.
>
> Source: [NIST SP 800-63B-4, Section 3.1.1.2](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/)
> Link: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/#f-nist-blocklist-with-reason



<a id="f-nist-password-managers"></a>
> **Finding f-nist-password-managers:** Verifiers shall allow password managers and autofill, should permit paste, and should accept passwords of at least 64 characters.
>
> Source: [NIST SP 800-63B-4, Section 3.1.1.2](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/)
> Link: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/#f-nist-password-managers


<a id="evidence"></a>
## Evidence


**Sources**

| Study | Year | Sample | Method | Finding |
| --- | --- | --- | --- | --- |
| [NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/) (NIST) | 2025 | n/a | Standard | Section 3.1.1.2 sets the password verifier requirements summarized here. |

| [SP 800-63B-4 Appendix A: Strength of Passwords](https://pages.nist.gov/800-63-4/sp800-63b/passwords/) (NIST) | 2025 | n/a | Informative appendix | Explains why length and blocklists matter more than composition rules. |


<a id="what-to-do"></a>
## What to do

<a id="for-engineers"></a>
### For engineers

- Set the minimum by how the password is used: 15 characters where it is the only factor, 8 only where a second factor is always required.
- Accept long passwords and verify them in full; the essay on [long password support](https://www.janbrennenstuhl.eu/long-password-support/) covers hashing limits and denial-of-service concerns.
- Replace composition rules with a blocklist check against breached and common passwords. The field-guide entry on [stolen credentials](https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/) covers privacy-preserving breach checks.
- Make forms work with password managers: the right `autocomplete` values and no paste blocking. See [password-manager friendly login forms](https://www.janbrennenstuhl.eu/password-manager-friendly/).

<a id="for-product-and-ux"></a>
### For product and UX

- Explain a rejection in plain words ("this password appears in known breaches") instead of listing rules after the fact. NIST requires a reason.
- Drop scheduled password expiry. Forced changes are for evidence of compromise, which makes them rarer and easier to explain.
- My [2023 password policy essay](https://www.janbrennenstuhl.eu/password-policy/) recommended at least 12 characters. For passwords used on their own, the final SP 800-63B-4 now sets 15.

<a id="check-your-policy"></a>
## Check your policy


<a id="ex-password-policy"></a>
**Compare a policy with SP 800-63B-4** (interactive on the web page; static explanation follows)

The checker on this page compares the settings of a password policy with the requirements below. Without JavaScript, use the list as a checklist. "Shall" is a requirement, "should" a recommendation.

- **Shall:** at least 15 characters for single-factor passwords; at least 8 if the password is only one factor of MFA.
- **Should:** accept at least 64 characters, all printing ASCII characters, the space character and Unicode; count each Unicode code point as one character.
- **Shall not:** impose composition rules, such as requiring digits, symbols or mixed case.
- **Shall not:** require periodic password changes. **Shall:** force a change when there is evidence of compromise.
- **Shall not:** offer password hints to unauthenticated users, or prompt for security questions when a password is chosen.
- **Shall:** verify the whole password, never a truncated or partial one.
- **Shall:** check new passwords against a blocklist, and tell the user why a password was rejected.
- **Shall:** rate-limit failed authentication attempts.
- **Shall:** allow password managers and autofill. **Should:** allow paste and offer to show the password.
- **Shall:** store passwords salted and hashed with a suitable password hashing scheme, with a salt of at least 32 bits.


<a id="related"></a>
## Related

- [Do password strength meters work?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/)
- [How common is password reuse?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/)
- [Max password length: a secure password guide](https://www.janbrennenstuhl.eu/max-password-length/)


---

Cite as: Jan Brennenstuhl. "What should a password policy require?." Brennenstuhl on Security, 13 October 2026. https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/
License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) for the original text; credited third-party media keep their own rights.