NIST SP 800-63B is the "authentication" volume of the Digital Identity Guidelines. It's written for organisations running logins, not for individuals, but it has become the reference most security teams cite. Revision 4 was finalised in 2025. The rules below use its own terms: shall means required, should means recommended.
NIST password guidelines, explained
The US National Institute of Standards and Technology's advice on passwords, from Special Publication 800-63B, in plain English, and what it means when you pick one.
| Topic | Guideline (paraphrased) | What it means for you |
|---|---|---|
| Minimum length (shall) | At least 15 characters when a password is the only factor; at least 8 when it is part of multi-factor authentication. | Length is the main lever. Five random words are ~35+ characters. |
| Maximum length (should) | Permit at least 64 characters. | Long passphrases should be accepted. |
| Characters | Accept all printable ASCII characters and the space; Unicode should be accepted too. | Spaces between words are legitimate. |
| Composition rules (shall not) | No other composition rules, such as requiring mixtures of character types. | "Must contain a symbol" is outdated advice. |
| Expiry (shall not) | No forced periodic changes; force a change if there is evidence of compromise. | A strong passphrase can stay as long as it isn't leaked. |
| Blocklists (shall) | Compare new passwords against lists of breached, common and context-specific values (like the site name). | Famous phrases like "correct horse battery staple" should be rejected. |
| Hints and security questions | No hints accessible before login; no knowledge-based questions ("first pet?"). | Your passphrase stays the only secret. |
| Password managers | Allow password managers and autofill (shall); permit paste (should). | Sites that block paste are going against the guidance. |
| Throttling | Limit failed login attempts. | This is why online guessing is slow and offline guessing matters more. |
Why length replaced complexity
Composition rules were meant to force randomness. In practice people satisfy them the same way, so they add little real strength and a lot of frustration. The move was to ask for something people can actually do well: make it long.
How a passphrase fits the guidance
- Length: five EFF words with hyphens average about 39 characters, far above the 15-character minimum.
- No composition tricks needed: strength comes from random word choice, which is exactly what composition rules were trying and failing to produce.
- Not on a blocklist: a freshly generated random phrase won't be on any breach list, as long as you don't reuse it.
Many sites still enforce old-style rules. If yours does, the memorable password generator adds the required capital, digit and symbol, and its AI helper can read the rules for you.
Source: NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Authenticator Management, available at pages.nist.gov/800-63-4. This page paraphrases it; check the original for exact requirements.
Questions
What are the current NIST password guidelines?
They are in NIST Special Publication 800-63B, part of the Digital Identity Guidelines; Revision 4 was finalised in 2025. In short: favour length (at least 15 characters for a password used on its own, 8 when it is one factor of multi-factor authentication), accept long passwords and all printable characters including spaces, drop composition rules and scheduled password changes, screen new passwords against lists of breached and common ones, and let people paste and use password managers.
Does NIST still require special characters?
No. SP 800-63B says verifiers shall not impose composition rules such as requiring a mix of character types, because people respond with predictable patterns like a capital first letter and "1!" at the end.
Does NIST recommend changing passwords every 90 days?
No. Verifiers shall not require periodic changes. They shall force a change when there is evidence it has been compromised.
Are passphrases NIST compliant?
Yes. A random passphrase of five or more words is well over the 15-character minimum and contains no predictable composition pattern. NIST also asks verifiers to accept spaces, so "word word word word word" style passphrases should work.