Modern Password Policy: What NIST SP 800-63B Actually Recommends

Most organizations still run a password policy written around 2004: eight characters, one uppercase, one number, one symbol, expires every ninety days. Every element of that policy is now explicitly discouraged by the standard it was meant to satisfy. NIST Special Publication 800-63B reversed the guidance years ago, and CompTIA exams have followed.

If you learned password rules from an old course, this is the section worth rereading.

Length Beats Complexity

Composition rules — forcing a symbol and a digit — produce predictable output. Told to add complexity, people capitalize the first letter and append 1!. Cracking tools apply exactly those transformations first, so the rule adds almost nothing to the search space while making the password harder to remember.

Length does the real work, because each additional character multiplies the space rather than adding to it. Current guidance is a minimum of eight characters with a strong preference for longer, support for at least sixty-four, and acceptance of spaces and all printable characters so passphrases are usable.

The practical recommendation is a memorable passphrase of four or five unrelated words, or — better — a generated random string stored in a password manager.

Stop Forcing Periodic Rotation

Ninety-day expiration was intended to limit the useful life of a stolen credential. In practice it produced Summer2024! becoming Autumn2024!, which is no defense at all against anyone who has seen the previous password.

Current guidance: rotate on evidence of compromise, not on a calendar. Evidence means a confirmed breach, a credential found in a dump, or anomalous authentication activity.

This trips people up on exams. The correct answer to "how should password expiration be configured" is increasingly "on compromise" rather than a number of days. Read the scenario for whether it is testing current guidance or a legacy compliance requirement that still mandates rotation — both appear.

Screen Against Breached Passwords

This is the control that replaced rotation, and it is the one most organizations have not implemented.

When a password is set or changed, check it against a list of known-compromised values — credentials from public breach corpora, dictionary words, context-specific terms like the company name, and repetitive or sequential strings. Reject matches and explain why.

The reason this matters is credential stuffing. Attackers do not guess passwords; they replay username and password pairs harvested from other sites' breaches, relying on reuse. Screening at set time is what breaks that chain, because the password that leaked elsewhere never becomes valid here.

Signals that stuffing is underway — a flood of authentication failures across many accounts from few sources, successes arriving from unexpected geography — surface well through impossible travel detection and correlation in a SIEM.

What Else Changed

• No password hints. They leak to anyone who can reach the login page.
• No knowledge-based recovery questions. Mother's maiden name and first school are research targets, not secrets.
• Allow paste. Blocking paste breaks password managers, which pushes users back to memorable and therefore weak passwords.
• Rate-limit authentication attempts rather than relying on lockout alone. Aggressive lockout thresholds turn into a denial-of-service vector against your own users.
• SMS is discouraged as a second factor because of SIM swapping and interception, though it remains better than no second factor.

Passwords Are Not the Whole Control

Even a well-built policy is one layer. Multifactor authentication remains the single highest-value control against credential attacks, and phishing-resistant factors — hardware security keys and platform authenticators — defeat the real-time proxy phishing that one-time password codes do not.

For accounts that matter most, policy is not enough either. Administrative and service credentials belong under privileged access management with checkout, session recording and automatic rotation. And in enterprise environments, reducing the number of passwords in circulation at all — through federated single sign-on — shrinks the attack surface more than any policy tuning will.

Exam Focus

Know that length is preferred over complexity, that rotation should be triggered by compromise, that breached-password screening is the modern replacement for expiration, and that knowledge-based recovery is deprecated. Recognize credential stuffing from the description — valid credentials from another source, high failure volume, no brute-force pattern — and know that MFA and breach screening are its specific countermeasures.

The short version: fewer rules, longer secrets, and a check against what has already leaked.