Length beats symbols: what NIST’s password rules now say

The US National Institute of Standards and Technology has published the fourth revision of its digital identity guideline, SP 800-63B. It is the document many governments and companies copy when they write login rules, and this edition drops two habits most people were trained into: mixing capitals, numbers and symbols, and changing your password every few months.

What the guideline asks of websites and systems

• At least 15 characters when a password is the only thing protecting the account, and at least 8 when it is one part of multi-factor sign-in.
• Room for at least 64, so a whole phrase fits.
• No composition rules. Systems shall not force a mix of character types.
• No scheduled resets. Users are not made to change passwords periodically, only when there is evidence one has been compromised.
• A blocklist. A new password is checked in full against known common, expected and breached passwords, and refused if it is on the list.
• No hints and no security questions of the “name of your first school” kind.
• Pasting and password managers are allowed, and systems should accept spaces and Unicode, counting each character once.

What it means for you

The guideline is written for the people who build systems, and it binds no one outside US federal agencies. But it explains why length matters more than clutter: a long phrase of unrelated ordinary words is harder to guess than a short string stuffed with symbols, and far easier to remember. Because Unicode is accepted, a phrase in Arabic works on systems that follow it.

When a site still demands a capital letter and a symbol, it is running the old rules. A password manager can generate something that satisfies it and remember it for you.

Photo: A keyboard with blank keycaps, illustrative. Michael Coté, CC BY 2.0, via Wikimedia Commons.

Source: NIST SP 800-63B-4, section 3.1.1.2 “Password Verifiers”, read on 3 November 2026.