Your Password Policy Is Probably Outdated. Here’s What NIST Says to Do Instead.

TL;DR

• NIST finalized new password rules (Special Publication 800-63B-4) on July 31, 2025, replacing guidance that shaped corporate policy for roughly two decades.
• Longer beats complicated. When a password stands on its own, NIST now calls for at least 15 characters. A passphrase made of ordinary words beats an 8-character string full of symbols.
• Forced password changes are out. Rotate only when something has actually gone wrong.
• Move off SMS-based multi-factor authentication. CISA names FIDO/WebAuthn and PKI-based methods as the phishing-resistant alternatives.
• Passkeys are where the industry is heading. 87 percent of large U.S. and UK enterprises are already deploying them.

For a quick refresher on what actually makes a password strong, see our guide here.

If your organization still forces people to change their password every 90 days, demands a mix of upper-case and lower-case letters, numbers, and symbols, and asks “what was the name of your first pet?” when someone hits the reset link, your security policy is so 2000.

And we get it. Nobody wakes up excited to revise password policies. But the advice everyone has been following for the last twenty years doesn’t just feel dated; the federal agency that wrote the original rules now says most of them make things worse, not better.

On July 31, 2025, the National Institute of Standards and Technology finalized Revision 4 of Special Publication 800-63B, the document that sets authentication rules for U.S. federal systems that federal agencies must follow. The private sector doesn’t have to, but most of the security industry treats it as the default reference. The 2025 revision quietly reversed several of the rules that shaped corporate password policy for two decades.

What the new rules say

Six changes do most of the work:

• 15-character minimum for single-factor passwords. Passwords that stand on their own must be at least 15 characters. Passwords backed by MFA can be shorter, but at least 8 (ViaTek believes that 8 is too short in any circumstance). Of course, we all already know that no password should be standing on its own in 2026, right? MFA everywhere is the rule.
• Max length of at least 64 characters. No low ceilings. Systems must accept long passphrases.
• No composition rules. NIST is explicit: “SHALL NOT” impose mixtures of upper-case, lower-case, numbers, and symbols. The forced “!” at the end of your password is finally retired.
• No periodic rotation. Same “SHALL NOT” language. Passwords change only when there is evidence of compromise.
• Known-bad passwords get screened out. NIST wants systems to check new passwords against a list of the most-used and most-breached ones. Curious how yours stacks up? Keeper’s password strength meter is a good place to test.
• No password hints, no security questions. “Your mother’s maiden name” is out. Those answers are on LinkedIn anyway.

Longer, yes. More complicated, no. The burden has moved from the user (who used to memorize absurd strings) to the system (which now has to check passwords against what attackers are actually cracking).

Why the old rules got thrown out

Most of what is still sitting in corporate policy documents came from NIST guidance written in the early 2000s. Well-intentioned but wrong by today’s standards.

Forced rotation was the biggest mistake. Tell someone to change their password every 90 days and you do not get a new password. You get a tweak. Summer2024 becomes Summer2025. Password1 becomes Password2. Attackers who crack one version usually guess the next on the first try. Research from NIST itself, combined with work from Carnegie Mellon and former FTC CTO Lorrie Cranor, confirmed what most of us suspected all along: scheduled rotation produces weaker passwords, not stronger ones.

Composition rules have the same problem in a different outfit. Requiring an upper-case letter, a number, and a special character sounds like it raises the bar. But in practice, it pushes everyone toward the same predictable templates. Password1!, Welcome2024!, Company123!. Attackers know the patterns people reach for, which narrows the guess space rather than widening it.

Length does the real work. A 16-character passphrase made of ordinary words is far harder to crack than an 8-character string crammed with symbols, and people can actually type it. The 15-character floor in the new rules is built on that simple piece of math.

And security questions? The answers are almost never secret. Maiden names, pet names, high schools. They turn up on social media, in property records, or one phishing email away.

The myths that won’t die

Old advice keeps showing up in policy documents and training decks long after the guidance has moved on. The biggest offenders:

“Change your password every 90 days.” The new document explicitly says organizations SHALL NOT require periodic changes. Rotate only if there is evidence of compromise.

“A strong password has to mix letters, numbers, and symbols.” Composition rules are prohibited in the 2025 guidance. A long, memorable passphrase beats a short complex one every time.

“Security questions are a safe backup.” They are not. The answers are discoverable, which is why they are out.

“SMS text codes are good enough for multi-factor authentication.” The Cybersecurity and Infrastructure Security Agency classifies SMS as a “last resort” MFA option, vulnerable to phishing, SIM swap attacks, and interception via the SS7 protocol. Better than nothing, but not where you want to stop.

“Long passwords are too hard for regular people.” They are not. If you give people a password manager and mandate passphrases, people will have a much easier time adhering to the new rules.

What to do now

If you are just trying to keep your own accounts safe

Step one: get a password manager and actually use it. Not a sticky note. Not a Word document. Not your browser’s built-in autofill. A real password manager. 1Password, Bitwarden, Keeper, take your pick. Pay for it if you need to and move your accounts over a few sessions at a time. This one move does more for your security than every password rule ever written.

Step two: turn on MFA everywhere it’s offered. When the site gives you a choice between an authenticator app and SMS text codes, always pick the app. Any MFA is better than none, but text messages can be intercepted in ways an app on your phone can’t.

Step three: when a site offers you a passkey, take it. You log in with a fingerprint, PIN, or (hopefully) your password manager instead of a password, and there is literally nothing for an attacker to steal in a breach.

Step four: stop answering security questions honestly. If a site forces you to pick one, treat the answer like a password. Something random, stored in your manager. “First pet” is not Fluffy. “First pet” is a 30-character random string only your password manager knows.

If you set policy for a team or business

Raise your minimum password length. NIST says 15 when a password stands alone and 8 when MFA is in play. ViaTek thinks 8 is too short, full stop. Set the floor at 15 and write it into the policy document. If it is not in the written policy, someone will undo it in six months.

Move away from SMS-based MFA. Deploy authenticator apps or hardware keys across the organization, starting with the people who will do the most damage if their account gets popped. Executives, admins, anyone with production access.

Retire security questions as a recovery path. Give every employee an enterprise password manager. And start piloting passkeys in your identity platform if you haven’t already. They’re ready.

The slow end of the password

Here is the bigger picture: the best password is increasingly no password at all. Passkeys, which are cryptographic credentials stored on your device and unlocked with a SSO, fingerprint, facial recognition, or PIN, have moved from pilot to mainstream faster than almost anyone predicted. Windows Hello for Business is essentially another form of passkeys and are a great way to increase security by leaps and bounds.

The FIDO Alliance reported in 2025 that 87 percent of surveyed U.S. and UK enterprises with 500 or more employees had deployed passkeys or were actively deploying them. On the consumer side, 69 percent of users now have at least one passkey, and about half of the top 100 websites support them. Login success with passkeys runs about 93 percent, compared to 63 percent for passwords.

Passwords are not disappearing tomorrow. Too many legacy systems still depend on them, and they will for years. But the direction is clear, and the 2025 NIST guidance explicitly accepts syncable passkeys at the assurance level most businesses operate at.

The short version: the password rules that shaped corporate security for twenty years have been rewritten. The rewrite points at a future where passwords are one of several authentication options, and usually not the best one.

Sources

NIST SP 800-63B-4

• Final publication page
• HTML version
• PDF

CISA

• Implementing Phishing-Resistant MFA fact sheet

FIDO Alliance

• 87% enterprise deployment research
• Passkey Index 2025

UK NCSC

• Password guidance collection