What the current NIST guidance says about passwords
The 2025 edition of the NIST digital identity guidelines drops several habits that made passwords worse. A short reading for anyone who sets the rules.
Length first
The guidance asks for at least 15 characters when a password is the only thing protecting an account, and at least 8 when it is used together with a second step. Services should accept passwords of 64 characters or more, including spaces, so that long phrases and password managers work.
Rules that are gone
Services must not demand a mix of capitals, digits and symbols. Such rules produce predictable results like “Password1!” and add little real strength.
Services must not force a change every few months. A password is changed when there is evidence that it has leaked. Hints and security questions such as a first pet’s name are not allowed either, because the answers can be found or guessed.
Checks that are required
A new password is compared with a list of passwords that are common, expected or known from leaks, and rejected if it is on the list. The number of wrong attempts is limited.
Pasting into the password field should be allowed. Blocking it gets in the way of password managers, which are the practical way to have a long, unique password everywhere.
This note is our own plain-language summary. For the full guidance, read the original: https://csrc.nist.gov/pubs/sp/800/63/b/4/final
Next notePublic Wi-Fi without the drama
A long password nobody else uses beats a clever short one.