NIST password guidelines 2025: what SP 800-63B-4 changed
The United States standard for digital identity was finalised on 31 July 2025. Its password rules overturn habits many organisations still enforce.
The short version
NIST Special Publication 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, was published as final on 31 July 2025. It replaces the 2017 revision. It is binding on United States federal agencies and widely copied by companies, auditors and other governments. For passwords, section 3.1.1.2 says a verifier (the system that checks your password):
- Shall require at least 15 characters when the password is the only authentication factor.
- Shall require at least 8 characters when the password is used only as part of multi-factor authentication.
- Should allow at least 64 characters, so long passphrases fit.
- Should accept spaces and Unicode, counting each Unicode code point as one character.
- Shall not impose composition rules such as requiring a mix of uppercase, lowercase, digits and symbols.
- Shall not require periodic changes, but shall force a change when there is evidence of compromise.
- Shall compare new passwords against a blocklist of commonly used, expected or compromised values.
- Shall not allow password hints readable before login, and shall not use security questions when a password is chosen.
What changed from the 2017 version
The 2017 revision, SP 800-63B, already advised against composition rules and forced expiry, but mostly as recommendations. The 2025 revision turns several of them into requirements using the word "shall", and raises the single-factor minimum from 8 to 15 characters. That change is the one most organisations will feel: an 8 character minimum, still the default in many systems, no longer meets the guideline for a password that stands alone.
Why NIST dropped complexity rules and forced resets
Composition rules sound strong but produce predictable passwords. Told to include a capital, a digit and a symbol, most people write a word with a capital first, digits at the end and an exclamation mark, which is the first pattern cracking tools try. Forced changes every 90 days do the same: people increment a number. Length and screening against breached passwords do more, with less friction.
What it means for you
If you use passwords
Use a password manager, let it generate at least 16 random characters for each account, and protect the manager with a long random passphrase. Turn on a second factor where offered. You can stop rotating passwords on a schedule unless an employer still requires it.
If you set password policy
Set a 15 character minimum for any password used alone, or 8 where a second factor is enforced. Allow at least 64 characters and spaces. Remove complexity requirements and scheduled expiry. Add a blocklist check against breached and common passwords at the moment a password is set, and rate-limit failed logins. Each of these is in section 3.1.1.2.
Check a password against these rules with the strength checker, or generate one that meets them with the 15 character generator.
Questions
Is NIST SP 800-63B-4 mandatory?
It is mandatory for United States federal agencies and their systems. For everyone else it is guidance, but it is the reference most security frameworks and auditors point to.
Does NIST still require special characters?
No. Verifiers shall not impose composition rules, which includes requiring special characters.
When was SP 800-63B-4 published?
The final version is dated 31 July 2025 on the NIST Computer Security Resource Center.
Sources
- NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (final, 31 July 2025), National Institute of Standards and Technology. Checked 18 October 2026.
- SP 800-63B-4, section 3.1.1.2: Password Verifiers, National Institute of Standards and Technology. Checked 18 October 2026.