Password Security: The NIST Guide

The Core NIST Shift: Length Over Complexity

The old advice — “use uppercase, lowercase, numbers, and symbols” — is no longer recommended by NIST. Their current guidance prioritises password length above all else. A 20-character passphrase is exponentially harder to crack than an 8-character “complex” password.

What NIST SP 800-63B Requires

✅ Use Long Passwords — Minimum 8 Characters, Aim for 15+

NIST mandates a minimum of 8 characters. Their 2024 draft (SP 800-63B-4) recommends at least 15 characters for general accounts. Systems must support passwords of at least 64 characters. The longer your password, the exponentially harder it is to crack through brute force.

✅ Stop Mandatory Periodic Rotation

NIST explicitly reversed the old “change your password every 90 days” policy. Forced rotation leads to predictable patterns (Password1 → Password2 → Password3). Only change a password if there is evidence it has been compromised.

✅ Never Reuse Passwords Across Sites

When one site is breached — and breaches happen daily — attackers immediately try your credentials on every other site (credential stuffing). One unique password per site limits the damage to a single account.

✅ Use a Password Manager

A password manager generates, stores, and automatically fills strong unique passwords for every site. You only need to remember one strong master passphrase. This is the only realistic way to comply with NIST guidance.

✅ Check Against Known Breach Lists

NIST requires new passwords to be checked against lists of known compromised passwords. Use Have I Been Pwned to check whether your email and passwords have appeared in known data breaches.

✅ Enable MFA — More Important Than Password Strength

NIST ranks multi-factor authentication above password complexity. Even a stolen password cannot be used without the second factor. Enable MFA on every account that supports it, starting with email and banking.

❌ No Password Hints or Security Questions

NIST prohibits knowledge-based authentication (security questions). Answers to “What was your first pet?” are often guessable, found on social media, or exposed in data breaches.

Creating a NIST-Compliant Passphrase

Pick 4–6 random unrelated words and connect them. This is memorable, strong, and NIST-approved:

sunrise·guitar·mountain·coffee·47
purple·thunder·keyboard·ocean·desk

A 5-word passphrase has roughly 77 bits of entropy — it would take billions of years to crack with current hardware.

Recommended Password Managers

• Bitwarden — Open-source, end-to-end encrypted, excellent free tier. Best for most people.
• 1Password — Premium UI, Travel Mode, family sharing. Popular with security professionals.
• KeePassXC — Free, offline, open-source. Maximum privacy, no cloud dependency.
• Proton Pass — From the ProtonMail team. Built-in email alias generation.

Your Action Checklist

1. Install a password manager (Bitwarden is free and a great starting point)
2. Set a strong master passphrase (4–6 random words, 20+ characters)
3. Update your email password first — email resets everything else
4. Update banking and financial accounts next
5. Enable MFA with an authenticator app on email and banking
6. Check your email addresses at haveibeenpwned.com
7. Gradually update remaining accounts over the following weeks

Official Resources

• NIST SP 800-63B — Digital Identity Guidelines
• Have I Been Pwned — Check Your Breach Exposure
• CISA — Use Strong Passwords