What NIST Says About Passwords
Many sites still demand a symbol, a number and a change every 90 days. The US standards body NIST has advised against several of those habits.
Make a strong passwordRandom passwords and easy-to-remember passphrases, made on your device.
Open the tool →
Which document this is
NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management, is guidance for organizations that run login systems, not for individual users. The version summarized here is the June 2017 edition with updates as of March 2020. NIST's page states that it was superseded by SP 800-63-4 on August 1, 2025, so check that newer version for the current text.
What the 2017 edition says
- Length: user-chosen passwords must be at least 8 characters, and systems should accept passwords of at least 64 characters.
- No composition rules: systems should not require mixes of character types or ban repeated characters.
- No routine changes: systems should not force periodic password changes, but must require a change if there is evidence of compromise.
- Check against lists: new passwords should be checked against lists of commonly used, expected or compromised passwords, and rejected if they match, with an explanation.
- Allow paste: systems should let people paste a password, which supports password managers.
What this means for you
This is our own reading. A long password or passphrase that you have not used anywhere else is a better choice than a short one with a few symbols added. A password manager lets you use a different one for every site. If a site asks for symbols or frequent changes, follow its rules, but know that it is stricter than the NIST guidance.
Make a strong passwordRandom passwords and easy-to-remember passphrases, made on your device.
Open the tool →
Sources
Checked on October 15, 2026. We summarize in our own words and only state what these sources support.
- NIST SP 800-63B (June 2017, updated 2020) — password length, composition, changes, lists and paste