What Is NIST SP 800-63B-4?
NIST, the US National Institute of Standards and Technology, publishes the Digital Identity Guidelines. Part B, SP 800-63B, covers how services should handle authentication, including passwords. The current version, SP 800-63B-4, is marked final and was published on 26 August 2025.
The document is written for organisations that run sign-in systems, and it is mandatory for US federal systems. It is also widely used as a benchmark by everyone else, which is why its password rules matter to you as a user: they show what good security practice looks like.
The Password Rules at a Glance
The table summarises the requirements for passwords (which NIST calls memorized secrets) in section 3.1.1.2. "Must" and "must not" correspond to NIST's SHALL and SHALL NOT, and "should" to its SHOULD.
| Topic | What NIST says | What it means in practice |
|---|---|---|
| Minimum length | Must be at least 15 characters when the password is the only factor. May be as short as 8 when used as part of multi-factor authentication. | Length is the main requirement. A 16-character random password clears the bar. |
| Maximum length | Should allow at least 64 characters. | Sites should not cap long passwords or passphrases. |
| Composition rules | Must not require mixtures of character types. | No more "one capital, one symbol" rules. |
| Forced changes | Must not require periodic changes, but must force a change if there is evidence the password is compromised. | Change a password when there is a reason, not on a calendar. |
| Blocklist | Must compare new passwords against a list of commonly used, expected or compromised passwords, including breach corpuses, dictionary words and context-specific words. | Services should reject common passwords such as 123456. |
| Password managers and paste | Must allow password managers and autofill. Should permit pasting. | Blocking paste harms security. Use a manager. |
| Characters | Should accept all printing ASCII characters and the space character, and should accept Unicode. | Spaces make passphrases possible. |
| Hints and security questions | Must not allow stored password hints and must not use knowledge-based authentication. | Questions like "your first pet's name" are not acceptable. |
| Rate limiting | Must limit the number of failed authentication attempts. | Slows online guessing. |
What Has Changed
Earlier versions of the guidelines already discouraged forced password changes and character-type rules, and set a minimum length of 8. The 2025 revision makes these firm: composition rules and periodic changes are now prohibited, and the minimum is 15 characters when a password stands alone. The shift reflects a simple idea. Length and unpredictability protect an account, while rules that push people toward patterns like Password1! do not.
What It Means for You
- Choose length over decoration. A long random password beats a short complicated one. See the numbers in our crack-time table.
- Use at least 15 characters for passwords that stand alone. Our 16 Character Password Generator meets that.
- Consider a passphrase for the few passwords you must remember. Spaces and long phrases are allowed. See passphrase vs password.
- Do not rotate passwords on a schedule. Change one when you suspect it was exposed, using our data breach checklist.
- Use a password manager and paste freely. Be wary of sites that block it.
- Avoid common passwords. Check yours with the Password Strength Checker.
What It Means for Site Owners
If you run a service with sign-in, the guidelines point to a clear checklist: remove composition rules and forced expiry, allow long passwords and paste, accept spaces and Unicode, screen new passwords against a blocklist of breached and common passwords, drop security questions and password hints, and rate-limit failed attempts. Store passwords as salted hashes made with a slow algorithm. The wider guidelines also cover stronger options such as multi-factor authentication. For users, passkeys are one such option.
Limits of This Summary
This page is a plain-English summary of one section of a long standard, and it is not compliance advice. The guidelines include many more requirements, such as how verifiers store and process secrets and how the different assurance levels apply. If you need to meet the standard, read the official text, linked below.
Sources
- NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management. Section 3.1.1.2 (memorized secrets), read on 7 October 2026. Document status: final, published 26 August 2025.