NIST SP 800-63-4 Rethinks Password Rules
In July 2025, the National Institute of Standards and Technology (NIST) published Revision 4 of its Digital Identity Guidelines (SP 800-63). The guidelines are the result of an almost four-year process with nearly 6,000 public comments. They break radically with password practices that have been in place for decades.
Contents
The end of old password rules
The most striking change concerns password requirements. They break with everything IT administrators have so far considered good practice. Regular password changes every 60 to 90 days and complex composition rules used to be the gold standard. The new guidelines explicitly prohibit exactly these practices.
The new approach requires passwords of at least 15 characters when a password is used for single-factor authentication. If it is used only as part of multi-factor authentication, the minimum is 8 characters. Systems should allow a maximum password length of at least 64 characters and accept all printable ASCII characters as well as Unicode characters. At the same time, composition rules that require a mix of character types are prohibited entirely.
The reasoning comes from research. A password of at least 15 characters made of simple words, such as “correct horse battery staple mountain,” is exponentially harder to crack than “P@ssw0rd123!” and easier to remember.
Science instead of tradition
Forced complexity leads, paradoxically, to weaker passwords. Users fall back on predictable patterns: a capital letter at the start, numbers at the end, common substitutions such as “@” for “a.” These patterns make passwords predictable for attackers.
Regular password rotation is now required only when there is evidence of compromise. Frequent changes lead to weaker passwords or predictable variations, such as “SecurePassword2024” becoming “SecurePassword2025.”
Password hints and security questions are prohibited entirely because they are often compromised through social engineering.
New security measures
The guidelines introduce a mandatory blocklist. All new passwords must be checked against lists of compromised passwords, dictionary words, and context-specific words.
At the same time, the guidelines explicitly require support for password managers and autofill. Systems should offer an option to display the password while it is typed, tolerance for typing errors, and input aids on mobile devices.
What changes for manufacturers
For developers, the guidelines mean fundamental changes. Existing password policy engines must be revised: remove composition rules, implement length validation, and integrate blocklist databases.
User interfaces need a function to display the password, must remove copy-and-paste restrictions, and must support very long passwords. Back-end systems require secure hashing algorithms, rate limiting, and Unicode support.
Legacy systems face particular challenges. Enterprise identity management systems, Active Directory policies, and compliance software are built on the old rules and need extensive changes. At the same time, new market opportunities open up for password managers and authentication services that follow the NIST guidelines.
Other new features
Revision 4 integrates syncable authenticators such as passkeys, adds new controls against deepfakes, introduces metrics for continuous evaluation, and takes subscriber-controlled wallets into account.
Implementation challenges
Implementation requires users to relearn. Decades of habits have to change, and many people have to learn that length matters more than complexity.
Compliance conflicts arise because many industry standards still prescribe the old password rules. Organizations find themselves caught between following NIST and meeting regulatory requirements.
Technical debt from years of outdated rules requires substantial investment in modernizing the authentication infrastructure.
Assessment
Revision 4 of the NIST Digital Identity Guidelines marks the move from traditional practices to security practices that are based on research and easier to use. Organizations can improve their security and make authentication more user-friendly at the same time.
For manufacturers, this creates new market opportunities and, at the same time, a need to modernize products. The era of short, complex passwords that must be changed regularly is over.
The complete guidelines are available as NIST SP 800-63 Revision 4, with the volumes on identity proofing (Volume A), authentication (Volume B), and federation (Volume C).
The new NIST guidelines directly affect product design, security architecture, and regulatory classification, especially in the context of the CRA, ETSI standards, and IEC 62443. If you want to understand what these changes mean for your products, a no-obligation call is a good way to sort it out.
