What NIST SP 800-63B actually says about passwords
The modern, evidence-based password rules: 8-character minimum (15+ recommended), allow paste and password managers, screen against breach corpora, and stop forcing rotation and composition rules.
The modern rules in one paragraph
NIST SP 800-63B tells verifiers to require passwords ("memorized secrets") of at least 8 characters and to recommend at least 15; to accept long passwords and all printable characters including spaces; to allow paste and password managers; to screen new passwords against lists of known-breached and common values; to rate-limit guessing; and NOT to impose composition rules or periodic expiration. It is guidance built from how attacks actually work, and it makes accounts both safer and less painful.
SP 800-63B is the authentication volume of NIST's Digital Identity Guidelines. It is mandatory for US federal agencies and has become the de-facto reference that regulators, auditors, and standards elsewhere point to for password policy. The current revision modernizes the old advice that produced brittle passwords like "Summer2024!".
What verifiers SHALL and SHOULD do
- **Length over complexity.** Require a minimum of 8 characters, and recommend a minimum of 15. Support passwords well beyond that (the guidance is that at least 64 characters be accepted). Length is the dominant factor in resistance to guessing.
- **Accept the full character set.** Allow all printable ASCII, spaces, and Unicode — so users can pick passphrases — and do not silently truncate.
- **Allow paste and password managers.** Permit the paste functionality and optional "show password," because both make it practical to use long, unique, random passwords from a manager.
- **Screen against known-bad values.** Compare prospective passwords against a blocklist of values from breach corpora, dictionary words, repetitive/sequential strings, and context-specific words (like the service name). Reject matches.
- **Rate-limit.** Throttle and eventually lock out repeated failed authentication attempts to blunt online guessing.
What to stop doing
- **No composition rules.** Do not mandate mixtures of uppercase, digits, and symbols — they push users into predictable patterns without adding real strength.
- **No periodic rotation.** Do not force routine password changes. Require a change only when there is evidence the password has been compromised.
- **No password hints or knowledge-based questions.** Both leak information to attackers.
Screening is what actually replaces the old rules
The reason it is safe to drop composition and rotation is that breach-corpus screening removes the passwords attackers try first. If you drop the old rules but skip the blocklist check, you have weakened your policy, not modernized it. Screening is the load-bearing control.
Pairing 800-63B passwords with phishing-resistant MFA is the intended end state: a strong, unique, screened password as one factor, and a FIDO2/WebAuthn authenticator as the second. The higher assurance levels in 800-63B explicitly favour hardware-backed, phishing-resistant authenticators.