📋 NIST Password Guidelines 2026: What Actually Changed (and Why Most IT Departments Are Still Wrong)

Most companies still force employees to change passwords every 60–90 days, ban pasting into login fields, and require uppercase letters, numbers, and symbols. NIST's own researchers called these practices counterproductive in 2017 — and the finalized update to NIST SP 800-63B in September 2024 makes it official. The current NIST guidance says: prioritize length, check against breached-password lists, allow paste, and drop the complexity theater entirely.

If your organization's password policy was written before 2020, it is almost certainly making users less secure, not more.

The Old Rules vs. What NIST Actually Says Now

The gap between what most organizations enforce and what NIST recommends is striking.

Source: NIST SP 800-63B-4, September 2024

Why the Old Rules Backfired

The mandatory-change and complexity era had good intentions but produced predictable, unintended consequences. Security researcher Bill Burr, who authored NIST's original complexity guidance in 2003, told the Wall Street Journal in 2017: "Much of what I did I now regret." The supporting research was thin, and real-world behavior exposed the problem quickly.

When forced to change passwords every 90 days, users don't create genuinely new passwords — they increment them: Password1! becomes Password2! becomes Password3!. Cracking rigs know this pattern. When forced to add symbols, users make predictable substitutions: a→@, e→3, o→0. These substitutions have been pre-loaded into every serious cracking tool for over a decade.

NIST SP 800-63B-4, Section 3.1.1 (September 2024): "Verifiers SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator."

NIST researchers reviewed studies of millions of real passwords and found that complexity rules consistently narrowed the effective search space for attackers — not because the rules were wrong in theory, but because human behavior under arbitrary constraints is highly predictable.

What NIST SP 800-63B-4 Actually Requires

Length Is the Real Measure of Strength

NIST now prioritizes length over complexity. The hard minimum remains 8 characters, but the guidance strongly recommends a minimum of 15 characters and requires that systems accept passwords up to at least 64 characters. The reasoning is mathematical: each additional character from a large, random pool adds more entropy than any complexity rule.

A random 20-character password using only lowercase letters (~94 bits of entropy) is stronger than a rule-compliant 8-character mixed-case password with symbols (~52 bits theoretical, far less effective against dictionary attacks).

No Mandatory Periodic Changes

Organizations must not force password changes on a fixed schedule. Passwords should only change when: - There is evidence of compromise - The user chooses to change it - The organization detects a security incident involving that credential

This eliminates the "90-day expiry" pattern that drives predictable incremental passwords without improving real-world security.

Breached Password Checking Is Required

New and reset passwords must be checked against lists of known-compromised credentials. This includes commonly used passwords, context-specific words (the service name, the username), and passwords that have appeared in prior data breaches. A password that fails this check must be rejected with guidance to choose a different one.

Free, privacy-preserving implementations exist — the Have I Been Pwned k-anonymity API lets applications verify passwords against 847 million+ breached credentials without transmitting the full hash.

Password Paste Must Be Allowed

Blocking paste in password fields forces users to type passwords manually — which means they choose shorter, simpler, more memorable ones. NIST explicitly prohibits blocking paste, recognizing that paste support is essential for password manager adoption. If your login page disables Ctrl+V, it is actively working against NIST guidance.

Complexity Rules Are Out

No more mandatory uppercase, lowercase, number, or symbol requirements. Users may be encouraged to use longer passwords, but forcing character types is gone. At the same time, all printable Unicode characters must be accepted — expanding the possible character set for users who type in non-Latin scripts.

Security Questions Are Prohibited

Knowledge-based authentication (KBA) — "What is your mother's maiden name?", "What was your first car?" — is explicitly banned as a recovery method. This information is often publicly available, guessable from social media, or extractable via social engineering, providing false security with real recovery failure modes.

What This Means for Organizations

If your policy still enforces any legacy practices from the left column of the table above, here is the priority order for remediation:

1. Remove forced periodic expiry — the single highest-leverage change; eliminates incremental patterns immediately
2. Remove complexity mandates — allow long passphrases without forcing symbols
3. Add breached-password checking at registration and reset — Have I Been Pwned API or equivalent
4. Allow paste in all login and password-change fields — unblock autofill across all systems
5. Remove security questions — replace with email OTP or authenticator app for account recovery

CISA (Cybersecurity and Infrastructure Security Agency), 2024: "Organizations should move away from periodic password changes and instead focus on breach detection, MFA implementation, and password manager adoption as their core credential hygiene practices."

For organizations subject to compliance frameworks: HIPAA, PCI-DSS 4.0, and ISO 27001 auditors increasingly reference NIST 800-63B-4. Periodic password changes were removed from PCI-DSS 4.0's required controls in 2022, aligning with NIST's position.

What This Means for You as an Individual

Even if your employer still runs legacy policies, you can apply NIST principles to every account you personally control:

• Use a unique, randomly generated password for every account. A password manager like NordPass generates 16–20 character random passwords and stores them under zero-knowledge XChaCha20 encryption. You remember one strong master password; NordPass handles the rest.
• Enable MFA — preferably not SMS. NIST recommends phishing-resistant second factors: TOTP authenticator apps, hardware keys, or passkeys. SMS OTP is accepted but flagged as weaker due to SIM-swapping risk.
• Check your accounts at haveibeenpwned.com. Change any credential that appears in a known breach. NordPass's built-in dark web monitoring does this automatically and alerts you in real time.
• For passwords you must remember, use a long passphrase. Six random words from the EFF Diceware list (~77 bits of entropy) beats any rule-compliant 8-character password.

Affiliate disclosure: the NordPass link above is an affiliate link. If you purchase through it, we earn a small commission at no cost to you. See our affiliate disclosure.

Frequently Asked Questions

Does NIST SP 800-63B apply to private companies?

NIST guidelines are mandatory for US federal agencies and systems that process federal data. Private organizations are not legally required to follow them, but they represent the current security research consensus and are widely adopted as best-practice benchmarks. HIPAA, PCI-DSS 4.0, and ISO 27001 auditors increasingly reference NIST guidance when evaluating password policies.

Should I still change my password if it hasn't been breached?

Not on a fixed schedule. NIST 800-63B-4 requires password changes only when there is evidence of compromise — not because 90 days have passed. If you use a password manager that generates a unique random password per account, periodic changes become even less necessary: a unique password exposed in one breach only affects that single account.

What minimum password length does NIST recommend in 2026?

NIST SP 800-63B-4 sets a hard minimum of 8 characters, recommends a minimum of 15 characters, and requires that systems accept passwords of at least 64 characters. For individual accounts managed via a password manager, 16–20 randomly generated characters is the practical sweet spot.

Is "Pa$$word1!" a strong password under the new guidelines?

No. Despite meeting legacy complexity requirements, this password has low effective entropy because the substitutions are in every cracking dictionary. NIST's mandatory breached-password check would flag variants of it. A randomly generated 16-character password from a password manager is far stronger — not because it follows more rules, but because it was chosen without human pattern.

What replaces security questions for account recovery?

Account recovery should use out-of-band verification: a one-time code to a registered email or phone number, an authenticator app confirmation, or a hardware security key. NIST explicitly prohibits knowledge-based authentication (KBA) because the answers are often guessable or publicly available.