Modern Password Security: New Rules That Actually Work

Stop making people change their passwords every 90 days, stop demanding a capital letter and a symbol, and start requiring length plus a check against known-breached passwords. That is not a loosening of standards. It is what the current NIST guidance actually says, and it produces stronger passwords because it stops fighting the way people behave.

What NIST changed, and why it matters to you

NIST finalised revision 4 of SP 800-63B in August 2025. It is a US federal standard for digital authentication, but it has become the de facto reference everywhere, partly because auditors cite it and partly because it is one of the few documents in this field that shows its reasoning. If someone in your business insists on 90-day rotation because “compliance requires it”, this is the document that says otherwise.

The core requirements are short enough to summarise accurately. Verifiers must require at least 15 characters for a password that is the only authentication factor, and may allow as few as eight when the password sits inside a multi-factor process. They should accept at least 64 characters so passphrases work, should accept every printing ASCII character plus the space, and should accept Unicode. They must not impose composition rules. They must not require periodic changes, though they must force a change if there is evidence the credential has been compromised. They must not store password hints that an unauthenticated visitor can read, and must not use knowledge-based questions such as a first pet’s name.

Read that chart as a pair of thresholds rather than a target. Eight characters is only acceptable because something else is also protecting the account. Fifteen is the floor when nothing else is. And the 64-character ceiling exists so that nobody has to shorten a passphrase to fit a badly written form.

The five rules that are now officially wrong

The five habits below are not merely out of fashion. Each is contradicted by a specific requirement in the current guidance, which is worth knowing when you have to defend the change to a sceptical colleague.

NIST sets out the reasoning in its appendix on password strength, and the example it uses is the honest one: a user who would have chosen “password” will choose “Password1” when told to add a capital and a digit. The guidance concludes that blocklists, properly hashed storage, machine-generated random passwords and rate limiting do more against modern brute-force attacks than any amount of composition rule, so no further requirements are imposed. The published document is worth keeping a link to for exactly those conversations.

Length instead of complexity

Length is the only password property that reliably costs an attacker more. Complexity rules add a handful of bits and a lot of resentment. Four unrelated words give you something memorable that is long enough to be expensive to crack, which is why passphrases keep winning in practice.

The attack this defends against is not a hacker typing guesses. Microsoft’s Digital Defense Report for 2025 found that more than 97% of identity attacks are mass password-guessing attempts, and that identity-based attacks rose 32% in the first half of 2025 alone. That is automation at enormous scale, working through lists of common passwords and credentials from previous breaches. Length and uniqueness are what take you off those lists.

Credential abuse has actually fallen in the DBIR rankings, to 13% of breaches, and Verizon is transparent that part of that drop comes from reclassifying some cases as pretexting; without that change the figure would have been 16%. Either way it is still a top-three route in. Falling out of first place is not the same as being solved.

Screen against passwords that have already leaked

The single highest-value change you can make to a password policy is to check new passwords against a list of credentials that have already appeared in breaches, and to reject the matches. NIST requires verifiers to compare prospective passwords against a blocklist of unacceptable values, and notes the list does not need to be enormous: its job is to stop the very common choices that an online attack would try before rate limiting kicks in.

Two practical routes. If you run Microsoft Entra ID, turn on the banned password list and add your own terms: your company name, your product names, your town, your sports team. If you want a broader check, Pwned Passwords exposes a free API that lets you test a password against billions of breached credentials without ever sending the password itself, using a k-anonymity range query. OWASP’s authentication cheat sheet covers the implementation detail if you are building this into your own application.

The password manager is the enabling control

You cannot ask people to hold 60 long unique passwords in their head. A password manager is the control that makes the rest of the policy possible, and it is cheap enough that the argument is usually about change rather than money.

For a ten-person business the starter tiers come in around USD 25 to USD 40 a month. Measured against the help-desk time a rotation policy consumes, it pays for itself inside a quarter. The features worth caring about are shared vaults with role-based access, a report showing reused and breached credentials, and clean offboarding when someone leaves.

One rollout note from experience: import people’s existing browser-saved passwords on day one, then run the reuse report, then fix the worst twenty. Starting with a clean vault and good intentions does not survive the second week.

Where passwords still matter in a passkey world

Passkeys are displacing passwords on the accounts that matter most, and that is the right direction. But passwords do not disappear. They remain the recovery path when a device is lost, the only option on older systems, the way service accounts authenticate, and the credential protecting the password manager itself.

So the policy splits. Where a password is backed by a second factor, NIST’s eight-character minimum is defensible and you can concentrate on blocklist screening. Where a password stands alone, treat 15 characters as the hard floor and ask why it is standing alone at all. The accounts in that second group are the ones to migrate first.

That migration order matters more than the policy wording. Our small-business cybersecurity checklist sets out which accounts to prioritise, and the guidance for remote and hybrid teams covers the device side, which is where saved credentials tend to leak from.

Service accounts, shared logins and the forgotten credentials

Every business has credentials that no policy covers. The Wi-Fi password printed on a card in reception. The shared login for the courier portal. The database account configured in 2019 by someone who has left. The API key in a configuration file in version control. These are the credentials that turn a minor compromise into a long one, because nobody rotates them and nobody notices when they are used.

The DBIR’s third-party research makes the point at scale: looking inside third-party cloud environments, Verizon found that resolving weak password and excessive permission findings took almost eight months to clear half of them. Eight months is long enough for a leaked credential to be bought, tested and used twice.

1. Inventory them. One spreadsheet, every non-personal credential, who owns it and where it is stored. This takes an afternoon and is always worse than expected.
2. Move them into the password manager in a shared vault with named access, rather than in a document, a chat thread or somebody’s memory.
3. Replace what can be replaced with managed identities, service principals or short-lived tokens that nobody has to remember.
4. Rotate on departure, not on a schedule. When someone with access to a shared credential leaves, that credential changes the same week.
5. Scan your repositories for keys and connection strings, and treat anything you find as already public.

A policy you could publish tomorrow

Here is a policy short enough that people will read it. Passwords are at least 15 characters, or at least 12 if the account also requires multi-factor authentication and your identity platform cannot enforce eight sensibly. Passphrases of four or more unrelated words are encouraged. No composition rules. No scheduled expiry. New passwords are screened against a breach list and against a company word list. Every password lives in the company password manager, and a credential is never reused across two services.

Then add the two clauses that do the real work. Any credential known or suspected to be compromised is changed immediately, and the account’s sessions are revoked. And every account that can move money, change DNS or administer the identity platform requires phishing-resistant authentication, not just a password of any length.

The UK survey found password policies are already among the most widely adopted controls, with 96% of large businesses having one, while only 47% of businesses require any form of two-factor authentication. That gap is the whole story. Nearly everyone has a password policy. Fewer than half have the control that makes a leaked password survivable. If you only have budget and attention for one change this quarter, it is not the password policy.

We write and implement password and authentication policy remotely for clients worldwide as part of our cybersecurity services, including breach-list screening, password manager rollout and cleaning up the shared credentials nobody owns. Get in touch with Eudora Technology to talk about your project.