NIST Password Guidelines: Length, Expiry and Screening Rules

The current NIST password guidelines are in NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, published as final in July 2025 and superseding the earlier SP 800-63B. A password used as the only authenticator must be at least 15 characters long (at least 8 when it is used only as part of multi-factor authentication). Verifiers should allow at least 64 characters, must not impose composition rules or require periodic password changes, and must check every new password against a blocklist of common, expected and compromised passwords.

Key Takeaways

• SP 800-63B-4 (July 2025) requires at least 15 characters for passwords used alone and at least 8 when used as part of MFA.
  
• Periodic password changes must not be required; force a change only when there is evidence of compromise.
  
• Composition rules, such as requiring a mix of character types, must not be imposed.
  
• Verifiers must allow password managers and autofill.
  
• Compliance requires documentation, enforcement, and evidence.
  

Passwords play a central role in authentication, even in organizations that have adopted modern identity architectures. Single sign-on, identity providers, and multi-factor authentication have reduced password exposure, but they have not eliminated it. Passwords remain embedded in legacy systems, SaaS platforms, customer portals, and administrative access paths.

Over time, NIST guidance on passwords has shifted away from the idea of making passwords stronger through rigid rules. Recent guidance has moved toward reducing real-world risk. One familiar example is routine password rotation. For years, changing passwords every 60 or 90 days was treated as a baseline control. In practice, it often led to predictable changes, reused patterns, and written passwords, while compromised credentials remained usable until the next scheduled reset. NIST’s guidance reflects years of observing this behavior and instead ties password changes to evidence of risk, such as compromise or exposure.

That same risk-driven thinking runs through NIST’s broader approach to passwords. The guidance assumes that passwords will be targeted, reused, and eventually exposed. Rather than trying to perfect passwords in isolation, NIST focuses on controls that reduce the likelihood of compromise and limit the impact when credentials fail.

The authoritative source for this guidance is NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, finalized in July 2025. It defines requirements for passwords (earlier revisions called them memorized secrets) and places them within a broader risk-based identity framework. For the related access controls in the federal control catalog, see our NIST 800-53 checklist.

Let’s translate that guidance into clear steps.

Scope and Applicability of Password Controls

Before enforcing technical controls, organizations must first define where passwords are used and where they are acceptable.

1. Identify all systems that rely on password-based authentication, including identity providers, internal applications, SaaS platforms, VPNs, cloud consoles, and customer-facing portals.
   
2. Classify account types such as workforce users, contractors, administrators, service accounts, and customers.
   
3. Document which systems allow passwords as a primary authenticator and which require stronger authentication due to elevated risk.
   
4. Record exceptions for legacy systems and define compensating controls such as MFA, network restrictions, or enhanced monitoring.
   

Password Length Requirements

NIST is explicit that password length is the most important factor in resisting guessing and credential reuse attacks for user-generated passwords.

Short passwords collapse quickly under both online and offline attack conditions. Longer passwords significantly increase the cost of guessing without increasing user friction when passphrases or password managers are used.

1. Require a minimum length of 15 characters for passwords used as the only authenticator, and at least 8 characters for passwords used only as part of multi-factor authentication.
   
2. Ensure systems support passwords of at least sixty-four characters to enable passphrases and password manager-generated credentials.
   
3. Accept all printing ASCII characters and the space character, and accept Unicode characters, counting each Unicode code point as one character.
   
4. Validate that passwords are not silently truncated during input, processing, or storage.

Password Composition Rules

Traditional composition rules were designed to increase entropy, but ironically, they often reduce it. 

For that reason, SP 800-63B-4 says verifiers and credential service providers shall not impose composition rules, such as requiring a mix of uppercase letters, numbers and symbols.

1. Review existing composition rules such as mandatory uppercase letters, numbers, or symbols.
   
2. Remove mandatory character-mix rules; SP 800-63B-4 does not allow them.
   
3. If another regulation or contract still requires composition rules, document the conflict as a deviation from SP 800-63B-4.
   
4. Ensure composition rules do not block password manager-generated passwords or discourage long credentials.
   

Screening for Compromised and Common Passwords

Blocking known weak passwords is one of the most impactful controls in NIST SP 800-63B. Many successful account takeovers rely on credentials that have already appeared in public breach datasets.

When a password is chosen or changed, SP 800-63B-4 requires verifiers to compare the entire password against a blocklist of commonly used, expected or compromised values, such as passwords from previous breach corpuses, dictionary words, and context-specific words like the service name or the username.

Compliance steps

1. Implement password screening during account creation and password changes.
   
2. Compare the full proposed password against a blocklist rather than checking substrings.
   
3. Maintain blocklists that include commonly used passwords and organization-specific terms.
   
4. Update blocklists regularly based on threat intelligence and internal incident data.
   

This control directly reduces the success rate of credential stuffing attacks and reused passwords.

Password Expiration and NIST Password Policy

SP 800-63B-4 says verifiers shall not require users to change passwords periodically, but shall force a change when there is evidence that the password has been compromised. Time-based expiration encourages predictable password changes and increases operational burden without reducing compromise risk.

After years of observation, NIST has concluded that when passwords are changed when there is evidence of risk, they are less likely to be generic. This makes a lot of sense. If you’d be prompted to change your password due to security reasons, you’re more likely to think of a strong password than if you get your monthly “friendly reminder” to change your password. 

1. Disable routine time-based password expiration across systems.
   
2. Define clear triggers for password resets.
   
3. Align password reset decisions with formal incident response procedures.
   
4. Document reset criteria in policy and operational runbooks.

Authentication Throttling and Rate Limiting

Online guessing and credential stuffing attacks rely on volume. NIST requires controls that make large-scale guessing impractical.

Rate limiting is a core defensive control for this risk.

1. Implement rate limiting on authentication attempts by account and source.
   
2. Apply progressive delays after repeated failed login attempts.
   
3. Monitor authentication logs for abnormal patterns that indicate automated attacks.
   
4. Limit consecutive failed attempts on an account to no more than 100 before disabling the authenticator (lower limits are allowed), and use measures such as increasing wait times or bot-detection challenges so lockouts are harder to abuse for denial of service.
   

Throttling reduces the likelihood of compromise even when passwords are weak or reused.

Password Manager Support

SP 800-63B-4 says verifiers shall allow the use of password managers and autofill, and should permit users to paste passwords. Password managers enable long, unique passwords and reduce reuse across systems.

Blocking password managers actively undermines security.

Compliance steps

1. Allow paste functionality in password fields across all authentication interfaces.
   
2. Remove client-side restrictions that block long or complex passwords.
   
3. Validate compatibility with common password managers during testing.
   
4. Document password manager support as an accepted security control.
   

Secure Password Storage

NIST assumes that credential stores may eventually be exposed. Password storage must be designed to resist offline attacks and limit blast radius.

Compliance steps

1. Store passwords salted and hashed with a suitable password hashing scheme, using a salt of at least 32 bits.
   
2. Use hashing approaches designed specifically for password storage.
   
3. Enforce encrypted transport for all authentication-related communications.
   
4. Restrict and monitor access to credential stores and authentication infrastructure.
   

Password Reset and Account Recovery

Account recovery flows are a frequent attack path because they bypass normal authentication controls. NIST treats recovery as part of the authentication lifecycle.

1. Use single-use reset tokens for password recovery.
   
2. Prevent account enumeration by avoiding confirmation of account existence.
   
3. Require step-up verification for high-risk recovery scenarios.
   
4. Invalidate active sessions after the NIST password change guidelines have been followed.
   

Mapping to NIST and Compliance Frameworks

Password controls should be traceable to authoritative standards to support audits and assessments.

1. Map password implementations directly to NIST SP 800-63B requirements.
   
2. Align controls with NIST SP 800-53 identification and authentication objectives.
   
3. Address NIST SP 800-171 requirements in regulated or CUI environments.
   
4. Document deviations and compensating controls clearly.
   

Ongoing Review and Evidence

Password security controls must be reviewed and adjusted as threats evolve.

1. Maintain written password and authentication policies aligned with NIST guidance.
   
2. Retain configuration evidence and system settings for audit purposes.
   
3. Preserve monitoring and incident response records related to authentication events.
   
4. Review controls periodically based on threat intelligence and incident trends.
   

FAQs

Is this guidance mandatory under NIST?

NIST SP 800-63B is published as guidance rather than regulation. However, it is widely treated as authoritative best practice and is frequently referenced by auditors, assessors, and regulators across both public and private sectors. Many organizations use it as the baseline for password and authentication policy design.

Does NIST require MFA instead of passwords?

No. NIST allows password-based authentication, but expects stronger authentication where access risk is higher. MFA decisions are intended to be risk-based, taking into account factors such as privilege level, data sensitivity, and exposure. Password guidelines NIST should be viewed as one component of a broader identity strategy.

Are complexity rules prohibited?

Yes, for systems that follow SP 800-63B-4: verifiers and credential service providers shall not impose composition rules, such as requiring a mix of character types. Length, blocklist screening and throttling do that work instead. If another regulation or contract still requires complexity rules, document the conflict and the compensating controls.

Do these rules apply to customer-facing accounts?

Yes, when an account takeover would create material security, privacy, or financial risk. Many organizations apply the same principles to workforce and customer accounts, particularly where customer credentials protect sensitive personal or financial data.

What is the NIST minimum password length?

SP 800-63B-4 sets two minimums: 15 characters when a password is the only authenticator, and 8 characters when the password is used only as part of multi-factor authentication. Verifiers should also permit passwords of at least 64 characters so that passphrases and password manager-generated passwords fit.

How does this guidance apply to legacy systems with technical constraints?

NIST recognizes that some legacy systems cannot fully meet modern password requirements. In these cases, organizations are expected to document limitations and apply compensating controls, such as MFA, access restrictions, monitoring, or segmentation, to reduce overall risk.

Does NIST consider password managers acceptable?

Yes. SP 800-63B-4 requires verifiers to allow password managers and autofill, and recommends allowing paste and long passwords. Password managers are viewed as a practical way to reduce reuse and improve overall password quality.