Example password policy — 2026 update (NIST SP 800-63B-4)

I wrote this post in 2020 and promised back then that I would update it once it got stale. That moment has come. 💥 In August 2025, NIST published the final version of its SP 800-63B-4 guidelines and flipped the table: no more mandatory special characters, no more periodic password changes. Below you’ll find the updated policy — and you’ll learn why some of the old “best practices” are actively harmful today.

What has changed since 2020?

Stolen passwords are still the number one attack vector. According to the Verizon DBIR 2025 report, as many as 88% of attacks against basic web applications involved stolen credentials, and the number of brute force attacks on web applications nearly tripled year over year.

What has changed is the defenders’ answer. NIST — the American standards institute whose guidelines the whole world ends up copying — has, in SP 800-63B-4, explicitly banned practices that passed for standard over the years: mandatory complexity and periodic password rotation.

Example password policy (current version)

Static passwords in IT systems should:

• be at least 15 characters long (the hard minimum per NIST is 8 characters, but the recommendation — especially when the password is the only safeguard — is 15);
• be accepted by the system at lengths of up to at least 64 characters, including spaces — so a whole phrase can be used, e.g. “a horse rides a bicycle on Mars”;
• NOT be subject to forced complexity — no mandatory “at least one uppercase letter, one digit and one special character”. NIST uses a hard “SHALL NOT” here — systems are not allowed to require it;
• NOT expire on a schedule — a password change only on suspicion or confirmation of a breach, not “every 30 days, just because”;
• be checked against a blocklist when set — lists of leaked, dictionary and obvious passwords (and rejected if found there);
• not contain the login, company name, application name, e-mail address, or the user’s first or last name;
• be stored exclusively as a hash: Argon2id (min. 19 MiB of memory, 2 iterations, parallelism 1); bcrypt in legacy systems (work factor of at least 10), and where FIPS-140 compliance is required — PBKDF2 with at least 600,000 iterations;
• allow pasting from a password manager — blocking “paste” in a password field is security sabotage, not protection;
• be unique — a different password for every service.

Why does length beat complexity?

“P@ssw0rd1!” satisfies all the old complexity rules — and falls in a fraction of a second, because attackers know the pattern perfectly: uppercase letter at the start, exclamation mark at the end, “a” swapped for “@”. Forced complexity produces predictable passwords and sticky notes under the keyboard. A long phrase is easy for you to remember and a nightmare for a machine to crack.

You’ll find plenty of useful information about implementing login securely in the OWASP — Authentication Cheat Sheet and the OWASP Password Storage Cheat Sheet.

A password manager — still the foundation

In most cases you don’t know how your passwords are stored by online services. Perhaps the administrator hasn’t implemented any mechanisms protecting your data. That’s why you have to take care of their security yourself — and with dozens of accounts and 15-character passwords, there’s no way to memorize them all. This is where a password manager comes in: you remember one strong password, and it takes care of the rest. One of the password managers considered secure and recommended is KeePass.

A password manager additionally gives you:

• automatic generation of long, random passwords;
• an encrypted vault and backups;
• synchronization across devices;
• automatic form filling — which also protects against phishing, because the manager won’t paste your password on a spoofed domain. 🔓

MFA — yes, but no longer SMS

In 2020 I wrote that an SMS code significantly increases account security. Today I have to correct that: SMS is the weakest form of two-factor authentication — vulnerable to SIM swapping and real-time phishing. Attackers are getting better and better at bypassing MFA: according to figures cited around DBIR 2025, the most common techniques are session token theft and “prompt bombing” — flooding the victim with notifications until they tap “approve”. ⚠️

In order from the strongest safeguard:

1. A hardware key (FIDO2) or passkey — phishing-resistant;
2. An app with TOTP codes (e.g. on your phone);
3. SMS — still better than no MFA, but treat it as a last resort.

Passkeys — a world without passwords?

Passkeys, i.e. access keys based on FIDO2, are already supported by Google, Apple and Microsoft, and NIST classifies them as phishing-resistant methods. Wherever a service offers them — turn them on. Today it’s the simplest way to stop the password from being the weakest link.

Summary

The new password policy is paradoxically simpler than the old one: long, unique passwords checked against a blocklist, with no artificial complexity and no forced rotation — plus a password manager and phishing-resistant MFA. Fewer rules, more security. ✔️

If you want to check whether the password policy in your company (and the rest of your defenses) can withstand contact with a real attacker — get in touch: I’ll test it as an ethical hacker and deliver a concrete report. And if NIS2 or DORA is breathing down your neck, have a look at the compliance page.