Why 800-63B dropped forced rotation and complexity rules
The old password rules were built on assumptions that turned out to be wrong. Here is the reasoning behind killing composition requirements and scheduled expiration — and how to explain it to skeptics.
For two decades, standard password policy meant three things: mix character types, change your password every 60 or 90 days, and answer some security questions. NIST SP 800-63B removed all three. The change is not about being lenient — it is that the evidence showed these rules made accounts weaker, not stronger.
Why complexity rules backfired
When forced to include an uppercase letter, a number, and a symbol, people follow predictable patterns: capitalize the first letter, put the number and symbol at the end ("Password1!"). Attackers know these patterns and bake them into their guessing tools, so the rules add little real entropy while pushing users toward passwords they cannot remember — which drives reuse and writing them down insecurely.
Why scheduled rotation backfired
Forcing routine changes leads users to make minimal, predictable edits — incrementing a number, swapping a season. If an attacker has the old password, the next one is easy to guess. Meanwhile everyone else is burdened for no benefit. The better trigger is compromise: change the password when there is actual evidence it has leaked, not on a calendar.
Replace the ritual with three real controls
Length (encourage passphrases, 15+ characters), uniqueness (a password manager so every account is different), and screening against breach lists. Add phishing-resistant MFA on top. That combination beats complexity-plus-rotation on every measure that matters.
Expect pushback — old habits and some legacy compliance checklists still assume the retired rules. It helps to point out that the guidance change came from NIST, the same body most of those checklists cite, and that many frameworks have updated to match. The compliance mapping shows where the modern rules already satisfy the obligation the old rules were standing in for.