Strong passwords per NIST 800-63B - length over "complexity"

The password rules everyone is used to - “at least one uppercase letter, a digit and a special character, changed every quarter” - the modern standard has dropped. NIST SP 800-63B “Digital Identity Guidelines” (the authoritative standard used by US federal agencies) says otherwise: length is what decides, and artificial composition rules only do harm. Here is what it actually recommends and how to build a password to match.

Core principles

1. Length is the most important thing. NIST sets:

a minimum of 8 characters - a mandatory requirement (SHALL) for any password;
a minimum of 15 characters - a recommendation (SHOULD) for a password used as a single factor (password-only login);
systems must allow at least 64 characters.

Allowing long passwords is not a formality: it lets the user choose a passphrase of several words that is both strong and easy to remember. Why length matters more than the character set is covered separately in the article on GPU password brute force.

2. No forced “character mixing”. Old rules demanded mandatory uppercase, digits and symbols. NIST explicitly says not to require this: the user may use any characters - including spaces and extended Unicode (emoji, non-Latin scripts) - but must not be forced to. Forcing only pushes people toward predictable patterns (Password1!) that an attacker tries first.

3. Screening against known compromised passwords. The system should reject passwords from lists of common, expected or breached ones: password123, 12345678, qwerty, letmein. These databases are large and public - which is exactly why this check gives a real security gain, not a cosmetic one.

4. No repetitive or predictable patterns. Weak, and to be rejected:

repetitive (aaaaaaa);
sequential (abc12345);
incremental (Password1, Password2).

5. No password hints. Hints give the attacker more than the account owner - NIST is categorically against them.

6. No scheduled “expiry”. Unlike the old rules, a password should be changed only on evidence of compromise, not on a schedule. Mandatory quarterly changes backfire: users turn Winter2025 into Spring2026, i.e. predictable variations.

How to build a password to this standard

Step 1. A long passphrase (15+ characters). Instead of a string of random characters - a phrase you can remember:

SolarWind$15BlueMoon
CoffeeAndSamosasAt10
Summer!Rain7OnBroadway

A long phrase is far harder to guess than a short password, even if it contains familiar words.

Step 2. Memorable but unpredictable. Good phrases combine several unrelated words, natural case changes, and digits or symbols in unexpected positions. Avoid famous quotes (“to be or not to be”), song lyrics and personal information - all of it is already in the attacker’s dictionaries.

Step 3. Check that the password is not breached. Before setting it, make sure it is not in a leak - Have I Been Pwned. If it is, pick another.

Step 4. Uniqueness is mandatory. A different password for every service. Then a breach of one account does not open the rest (a credential-stuffing attack). Keeping dozens of unique passwords in your head is impossible - so a password manager (Bitwarden, 1Password) generates and stores them for you.

Step 5. Spaces and Unicode - allowed if the system supports them. They add entropy but are not accepted everywhere:

Mountains ⛰️ River 🌊 Sunrise 2026

Long, unpredictable - and memorable.

Takeaways

Length matters more than “complexity”: a long passphrase is stronger than a short string of characters with special symbols.
Artificial composition rules and scheduled changes are obsolete; they push people toward predictable passwords.
Mandatory: uniqueness per service, screening against breaches, a password manager, and a second factor (MFA) wherever it is available.