NIST Password Guidelines 2026 — What They Say and Why They Changed

What NIST is and why its guidelines matter

The National Institute of Standards and Technology (NIST) is a US federal agency whose technology standards are widely adopted well beyond the United States. Its Special Publication 800-63B, "Digital Identity Guidelines: Authentication and Authenticator Management," is one of the most widely referenced password policy frameworks for governments, enterprises, and security professionals. When NIST changes its recommendations, the entire industry follows — eventually.

The shift: from complexity to length

The previous generation of NIST guidelines (and the password policies they inspired) mandated complexity: uppercase, lowercase, digits, symbols, and a minimum of 8 characters. They also mandated periodic password changes (commonly every 60 or 90 days), knowledge-based authentication questions ("your mother's maiden name"), and often short maximum length limits. NIST began reversing these practices in SP 800-63B revision 3 in 2017, and the fourth revision, SP 800-63B-4, finalized in July 2025, goes further, for example by requiring at least 15 characters for passwords used alone.

Current NIST SP 800-63B recommendations

What NIST now recommends: minimum 15 characters when a password is the only authentication factor; minimum 8 characters when it is combined with multi-factor authentication; maximum of at least 64 characters to support passphrases; all printable ASCII characters and Unicode accepted (including spaces); no mandatory composition rules (uppercase, special characters); no mandatory periodic password changes unless a breach is suspected; screening against breach databases — users should not be allowed to choose passwords known to be compromised; no password hints stored alongside passwords; no knowledge-based authentication questions.

Why complexity rules were dropped

Research found that forced complexity rules often failed to deliver the security benefit they were meant to. Users responded to "must include a symbol" by appending "!" to the end. They responded to "must change every 90 days" by incrementing a number: "Password1" → "Password2" → "Password3". These predictable adaptations made passwords more predictable and therefore easier to guess. NIST concluded that the benefit of composition rules is smaller than once assumed while their usability cost is high, which can push users toward worse practices like writing passwords down.

Breach database screening

One of the most impactful NIST recommendations is screening new passwords against known breach databases. If a user tries to create a password that appears in a known breach (like Rockyou2024), the system should reject it and explain why. This directly prevents the use of the most commonly guessed passwords. Services like the Have I Been Pwned API make this easy to implement: send the first 5 characters of the password's SHA-1 hash to the API and check the response against the full hash locally.

What organisations should implement based on current NIST guidance

Remove complexity requirements from password policies — mandatory composition rules push users toward predictable patterns without making passwords meaningfully harder to guess. Remove mandatory periodic password changes — require changes only when there is evidence of compromise. Increase minimum lengths — 15 characters when the password is the only factor, 8 when it is combined with multi-factor authentication. Support passphrases — allow spaces and long passwords. Implement breach database screening. Offer MFA on all accounts. These changes are not a relaxation of security: NIST's rationale is to stop forcing predictable user behaviour and to rely instead on the controls that matter, such as length, blocklists and MFA.

The practical takeaway for individuals

If your organisation's password policy still mandates complex passwords with frequent changes, the policy is outdated — but you still have to follow it. Make the best of it by using a password manager (which generates compliant passwords automatically) and MFA on every account that supports it. For accounts you control entirely: follow the NIST recommendations. Use long, random passwords of 16+ characters from a generator. Do not change them on a schedule — change them when there is reason to (a breach, a compromised device, a departing employee with access). Focus on length and uniqueness, not complexity.

Other requirements that protect users

The guidance covers more than the password itself. Services must allow password managers and autofill, and should permit pasting into the password field, which makes long random passwords practical. They must accept the whole password rather than truncating it, and they must limit consecutive failed attempts on an account to no more than 100 before the authenticator is disabled. Stored passwords must be salted and hashed with a suitable password hashing scheme, with a cost factor that is as high as practical and increased over time.

These details matter when you judge a service. A site that blocks pasting, silently cuts off long passwords or has no limit on guessing is working against current NIST guidance, and that is a good reason to enable MFA there and use a password that is unique to that site.