Password advice has shifted from “make it complicated” to “make it long.” This article explains what the main public guidance now says, why the old rules backfired, and how a team can update its own policy.
What did the new US identity guidelines change?
In August 2025, the US National Institute of Standards and Technology (NIST) released Revision 4 of Special Publication 800-63, its Digital Identity Guidelines. According to a NIST blog post dated August 1, 2025, the revision followed a nearly four-year process that included two public drafts and about 6,000 individual comments from the public.
The document covers identity proofing, authentication and federation, meaning the way one login can be trusted by many services. It is written for US government systems, but in practice it shapes what banks, software vendors and large employers copy into their own policies. NIST says the revision includes changes to “password composition and rotation expectations,” along with new controls for injection attacks and forged media such as deepfakes, and support for syncable authenticators such as synced passkeys.
Composition rules are the familiar requirements that a password contain an uppercase letter, a number and a symbol. Rotation means forcing everyone to change passwords every 60 or 90 days. The direction of travel is away from both.
What do NIST, CISA and the NCSC actually recommend?
The three bodies phrase things differently, but they agree on the core idea: length and uniqueness matter more than clever substitutions.
| Source | Core advice on passwords |
|---|---|
| NIST (consumer guidance) | A password should be at least 15 characters long; add multifactor authentication first; use a password manager for accounts that need passwords |
| CISA (Secure Our World) | At least 16 characters, a different strong password for each account, and a password manager |
| UK NCSC | Combine three random words; a password manager is an alternative that creates strong passwords you do not have to memorize |
Note the small gap: 15 characters from NIST, 16 from CISA. They are guidance for different audiences and should be read as “aim for at least this,” not as competing rules. The NCSC does not state a character count on its three-random-words page. It says only that the longer and more unusual a password is, the harder it is for a criminal to crack.
Why did forced complexity backfire?
Complexity rules ask people to do something humans are bad at: invent random characters they can also remember. People respond predictably. They capitalize the first letter, add a “1” or an exclamation mark at the end, and swap an “a” for an “@.” Attackers know these habits and build them into their guessing tools, so the extra rules add little real protection while adding a lot of frustration.
Forced rotation has a similar problem. When a system demands a new password every quarter, many people make a small edit to the old one. If a criminal already knows the previous password, the new one is easy to guess. Rotation also trains people to write passwords down or reuse them elsewhere, which is the very risk CISA warns about: one leaked password can expose several accounts.
The better trade is fewer rules, applied well. Ask for length, block known bad choices, and change passwords when there is evidence of a problem rather than on a calendar.
How much does length really add? A worked example
Illustrative arithmetic helps here. Assume a password is chosen truly at random, which people rarely do, so these numbers describe the best case.
- Eight characters from the full keyboard. Using roughly 94 printable characters, the number of possible passwords is 94 to the 8th power, about 6.1 quadrillion (6.1 × 10^15).
- Fifteen lowercase letters only. Using just 26 letters, the count is 26 to the 15th power, about 1.7 sextillion (1.7 × 10^21).
- Comparison. Dividing 1.7 × 10^21 by 6.1 × 10^15 gives about 275,000. The plain 15-letter password has roughly 275,000 times as many possibilities as the “complex” 8-character one.
The same logic explains the NCSC’s three-random-words approach. Suppose words are drawn at random from a list of 7,776 words (a size often used for dice-based passphrase lists):
| Words | Possible combinations | Approximate size |
|---|---|---|
| 3 | 7,776³ | 4.7 × 10^11 |
| 4 | 7,776⁴ | 3.7 × 10^15 |
| 6 | 7,776⁶ | 2.2 × 10^23 |
Three words alone are not enormous, which is why many security teams suggest four or more words for an important account, and why the randomness matters. A phrase like a song lyric or a famous quote is not random and is far weaker than the table suggests. These figures are mathematical illustrations, not predictions of how long any real attack would take.
Are passphrases and password managers the same thing?
No, and they solve different problems. A passphrase is a long password made of ordinary words, designed so a person can remember it. NIST’s own example, “cassette lava baby,” runs to 18 characters, and the agency describes such phrases as easier to invent and remember. A password manager is a program that generates, stores and fills in passwords for you, in CISA’s description, so that you only need to remember one strong password.
The two work best together. Use a long passphrase for the few secrets you must remember: the manager’s master password, your device login and your email. Let the manager create long random strings for everything else. NIST adds that the manager itself should support multifactor authentication, because its login guards everything inside.
Why does multifactor authentication come first?
NIST’s consumer guidance says the first thing to do is add multifactor authentication (MFA), which requires a second proof of identity such as a code or a hardware key in addition to the password. Even a strong password can be phished, meaning a user is tricked into typing it into a fake site. A second factor means a stolen password alone is not enough.
Not all second factors are equal. Codes sent by text message are better than nothing, but app-based codes and hardware keys are harder to intercept. Passkeys, which replace the password with a cryptographic key stored on a device, are the direction NIST’s new support for syncable authenticators points toward. Our guide to zero trust security for small teams explains how strong sign-in fits into a wider identity-first approach.
How can a team update its password policy?
A practical rewrite for a small organization might follow this order:
- Turn on MFA for email, finance tools, admin consoles and remote access before touching password rules.
- Set a minimum length of at least 15 characters for passwords used alone, in line with NIST’s consumer guidance, and allow long passphrases including spaces.
- Drop composition rules such as mandatory symbols, since the guidance now treats them as unhelpful.
- Stop calendar-based resets. Require a change after a suspected compromise, a leaked-credential alert or when a staff member leaves.
- Block known weak choices, such as common words, the company name and passwords seen in earlier breaches.
- Provide a password manager and short training on using it, so people are not left to improvise.
- Allow paste in login fields, which makes managers usable.
These steps pair naturally with the basics in our cybersecurity basics for small teams guide, such as updates, backups and account reviews. Check any regulatory or customer contract requirements before relaxing a rule, since some frameworks still specify older settings.
What are the limits of password advice?
Length does not help if a password is reused, phished or captured by malware on an infected device. It also does not help if a website stores passwords badly. That is why CISA stresses a unique password for each account: when one service is breached, the damage stays contained.
Guidance also differs by context. NIST’s Revision 4 is written for government systems and the services that connect to them; consumer pages from NIST, CISA and the NCSC are friendlier summaries. When a service sets its own maximum length or rejects spaces, follow its rules, and consider whether it deserves your business if the limits are strict.
A shorter policy with stronger results
The old model asked people to memorize something complicated and replace it often. The newer model asks for something long, unique and rarely changed, backed by a second factor and a manager. For a team, the biggest wins are usually the simplest: MFA everywhere it matters, a 15-character floor, no forced symbols, and resets only when there is a reason.
This article is general information about cybersecurity practices, not professional security or legal advice for your organization.
Sources: National Institute of Standards and Technology; Cybersecurity and Infrastructure Security Agency; UK National Cyber Security Centre
