A modern password policy that follows NIST SP 800-63B
Length over complexity, no forced rotation, breach screening, and rate-limiting. The evidence-based policy that replaces the composition rules everyone still copies from 2005.
What to implement
Set an 8-character minimum (support at least 64), screen new passwords against a breached-password list, stop forced periodic rotation, drop composition rules, allow the full character set, allow paste and password managers, and enforce rate-limiting plus MFA. This is what NIST SP 800-63B actually prescribes — and it is both more secure and less painful than legacy policy.
Most corporate password policies are archaeological: complexity rules, 90-day expiry, no-paste fields. NIST reversed most of that guidance years ago because the research showed it pushed users toward weaker, more predictable secrets. NIST SP 800-63B is now the reference standard, and aligning to it is a policy simplification, not a hardening tax.
The rules that change
- **Length, not composition.** Require a minimum of 8 characters (12+ is a reasonable org baseline) and support at least 64. Do not require mixtures of character classes — 800-63B explicitly drops composition rules.
- **No forced periodic rotation.** Do not expire passwords on a schedule. Force a change only on evidence of compromise (breach hit, detected credential theft).
- **Screen against known-breached passwords.** Check new and changed passwords against a blocklist of compromised and common values (e.g. the Pwned Passwords k-anonymity API or an internal list) and reject matches.
- **Allow all printable characters, including spaces and Unicode.** Passphrases and emoji must not be silently stripped or blocked.
- **Allow paste and password managers.** Never disable paste on password fields; it breaks managers and drives reuse.
- **No password hints and no knowledge-based "security questions."** Both are guessable and prohibited by the standard.
- **Rate-limit and throttle.** Limit failed attempts, add exponential backoff / lockout, and prefer this over complexity as your anti-guessing control.
Set the minimum at 12+, not 8
800-63B mandates 8 as the floor for user-chosen secrets, but 8 is genuinely weak against offline cracking. Choose a 12–14 character minimum for staff and require passphrases for privileged accounts, while keeping the standard's other rules. Length is the cheapest strength you can buy.
Storage: how the verifier must hold secrets
Policy is only half the job; the verifier's storage must match. 800-63B requires that passwords be salted and hashed with a memory-hard, purpose-built key-derivation function. Do not use bare SHA-256 or MD5.
- Hash with **Argon2id**, **scrypt**, **bcrypt**, or **PBKDF2** with a high iteration count, per current OWASP parameters.
- Use a **unique random salt per credential** (32-bit minimum per the standard; 128-bit is better).
- Consider an additional secret **pepper / keyed HMAC** stored in an HSM or secrets manager so a database leak alone doesn't yield crackable hashes.
- Re-hash on login when you raise parameters, so the estate upgrades transparently.
Where this fits with IAM
Passwords are one factor in a broader identity program. Pair this policy with RBAC and least privilege, a tight joiner-mover-leaver process, phishing-resistant MFA, and privileged access management. A perfect password policy on an account with standing domain-admin rights and no MFA is still a soft target.
How to verify the policy is live
Confirm the identity provider's password policy object shows expiry disabled and composition rules removed; test that a known-breached password is rejected at set-time; confirm paste works on the login form; inspect the hash column for an Argon2/bcrypt prefix; and review authentication logs for lockout/backoff on repeated failures.
Rollout without a helpdesk storm
- Deploy the new policy object in monitor/audit mode first to see what would be rejected.
- Turn off forced expiry immediately — it needs no user action and removes a standing weakness.
- Introduce breach screening at next password change rather than a mass reset.
- Communicate the "why": longer passphrases, no more quarterly changes, managers allowed.