NIST password guidelines: SP 800-63B explained

IST password guidelines (SP 800-63B) prioritize password length and real-world security over complexity rules. NIST requires a minimum of 8 characters, encourages longer passwords or passphrases for single-factor authentication, and requires systems to support at least 64 characters. It discourages forced password rotation and recommends against password hints and knowledge-based security questions. Passwords must be verified against compromised and commonly used credentials, and multifactor authentication is strongly encouraged.

The National Institute of Standards and Technology (NIST) is a federal agency under the U.S. Department of Commerce that develops standards and guidelines for federal systems.

Its password guidance, codified in Special Publication 800-63B "Digital Identity Guidelines," is mandatory for federal agencies and has become the de facto standard for commercial organizations seeking evidence-based password policy.

Major compliance frameworks, including HIPAA, PCI DSS, SOC 2, and ISO 27001, draw directly on NIST SP 800-63B requirements.

The evolution of NIST password guidelines

NIST password guidance has evolved through multiple revisions as researchers studied how users actually respond to different policy constraints. The NIST Cybersecurity Framework provides a broader risk management structure across an organization; SP 800-63B focuses specifically on identity and authentication requirements.

NIST published Revision 3 of SP 800‑63 in 2017 and updated SP 800‑63B in 2020. Revision 4 was finalized in July 2025, built on that foundation to address phishing-resistant authentication, passkeys, and the explicit prohibition of knowledge-based authentication.

The consistent driver across all revisions is the same: complexity rules and forced rotation produce worse security outcomes because users develop predictable workarounds.

Key terminology

Sections of the NIST special publication are presented as informational, normative, or both. Informational material is intended to help the reader understand the concepts. Normative content provides recommendations for companies to use when creating password policies. Pay particular attention to the following key terms:

• Shall and shall not: required actions
• Should and should not: recommended or discouraged actions
• May and may not: permitted or not permitted actions
• Can and cannot: possible or not possible actions

What changed in SP 800-63B Rev. 4

Revision 4 introduced several normative changes from Revision 3. Understanding what changed helps organizations identify gaps in existing policies.

The most consequential change for most organizations is the shift to SMS OTP. Many organizations deployed SMS-based MFA during the Revision 3 era.

Under Revision 4, SMS OTP no longer meets Authenticator Assurance Level 2 (AAL2) requirements, meaning systems protecting sensitive data must upgrade to FIDO2/WebAuthn authenticators, hardware tokens, or authenticator apps.

NIST password guidelines: composition and management

SP 800-63B Rev. 4 addresses password requirements across several key components, each of which maps to a distinct set of policy decisions and technical controls.

Password composition

SP 800-63B shifts password policy away from complexity toward length. Long, memorable passphrases deliver better entropy than short, complex passwords and reduce the friction that drives users toward insecure workarounds.

The specific composition requirements are:

• Minimum length: User-chosen passwords must be at least 8 characters. NIST recommends a minimum of 15 characters for systems relying on a single authentication factor. Machine-generated passwords must also be at least 8 characters under Revision 4.
• Maximum length: Systems should support passwords of at least 64 characters. Imposing a lower maximum prevents users from choosing long passphrases.
• Password complexity: SP 800-63B Rev. 4 prohibits mandatory complexity rules. Systems should accept all printable ASCII characters, Unicode characters, and spaces. Requiring uppercase letters, numbers, or special characters produces predictable substitution patterns without meaningfully improving entropy, which is why the guidance eliminates these mandates in favor of length requirements.

For organizations managing Active Directory password policies, these requirements translate into specific Group Policy settings (minimum length, maximum length support, and removal of complexity rules) that must be reviewed against the SP 800-63B baseline.

Password management

SP 800-63B defines how organizations must handle password lifecycle events:

• Password changes: Organizations shall not require periodic password rotation. Users change passwords only when there is a specific reason, such as evidence of compromise.
• Password history: Systems should compare proposed passwords against previous ones to prevent password reuse.
• Password auditing: Organizations must check new and changed passwords against a block list of prohibited credentials. Block lists should include passwords from previous breaches, common dictionary words, consecutive or repetitive patterns such as "12345" or "aaaa," and context-specific terms such as the organization's name or the user's username. Regularly finding weak passwords in Active Directory identifies accounts already non-compliant with this requirement.
• Account lockout: Systems shall limit the number of consecutive failed authentication attempts. NIST recommends no fewer than 10 failed attempts before a lockout. This threshold directly addresses brute force attacks and password spraying, two of the most common credential-based attack methods.
• Password storage: Organizations shall store passwords using salted cryptographic hashing. Approved algorithms include PBKDF2, Argon2, and bcrypt, all designed to make offline cracking computationally expensive.
• Password hints: Systems shall not permit the subscriber to store a password hint accessible to an unauthenticated user. Hint answers are often guessable or obtainable through public information.
• Security questions: Systems shall not use knowledge-based authentication. SP 800-63B Rev. 4 explicitly prohibits KBA, because the answers can be socially engineered or found in public data sources.

MFA and authenticator requirements

SP 800-63B defines three Authenticator Assurance Levels (AAL1, AAL2, AAL3). Systems handling sensitive data should meet AAL2 at a minimum, which requires two distinct authentication factors.

Revision 4 establishes a clear authenticator hierarchy. FIDO2/WebAuthn authenticators and hardware security keys meet AAL2 and AAL3 requirements. Time-based one-time password (TOTP) apps meet AAL2. SMS OTP no longer satisfies AAL2 due to the risks of SIM swapping and interception.

Biometrics functions as a "something you are" factor within MFA but does not qualify as a standalone authenticator. Organizations that deployed SMS-based MFA during the Revision 3 era need to evaluate and plan an upgrade path to phishing-resistant options.

Password managers

SP 800-63B explicitly supports password manager usage and requires that systems not block paste functionality. This is a normative requirement in Revision 4: blocking paste in password fields prevents password managers from working correctly, increasing the likelihood that users choose shorter credentials they can remember.

Organizations should provide or sanction an enterprise password manager as part of their credential security program. Doing so reduces reliance on human memory for long, unique passwords and makes compliance with length requirements the path of least resistance. For a fuller view of what strong credentials look like in practice, see Netwrix's guide to password best practices.

Service account passwords

Standard SP 800-63B password requirements apply to human users authenticating interactively. Service accounts (non-human identities used by applications and automated processes) require a different approach. Interactive passwords on service accounts are difficult to rotate, rarely audited, and frequently overprivileged, making them high-value targets for attackers.

Organizations should replace interactive service account passwords with managed service accounts, certificate-based authentication, or just-in-time privileged access. Zero standing privileges is the target end-state: service accounts receive exactly the access they need for as long as they need it, with that access revoked automatically afterward.

Netwrix Privilege Secure eliminates standing privileged accounts and provisions just-in-time access with full session recording. Download a free trial

How NIST password guidelines map to compliance frameworks

SP 800-63B requirements appear, directly or by reference, across the major compliance frameworks security teams encounter:

• HIPAA: The HIPAA Security Rule's Technical Safeguards (§164.312) require unique user identification and person authentication controls. HIPAA auditors assess whether password policies align with current NIST guidance as the recognized standard for healthcare entities.
• PCI DSS v4.0: Requirement 8 mandates password policies for accounts protecting cardholder data, including minimum length requirements and MFA for all non-console administrative access. PCI DSS v4.0 aligns with NIST's direction by strengthening MFA requirements and expanding its scope.
• SOC 2: Trust Services Criteria CC6.1 requires logical and physical access controls. SOC 2 auditors assess whether password policies reflect current best practices, with NIST SP 800-63B serving as the accepted baseline.
• ISO 27001: Annex A control A.9.4 covers system and application access control. Aligning password policy with SP 800-63B satisfies the intent of this control and provides auditable evidence during certification assessments.

For organizations subject to government contracting requirements, NIST SP 800-171 extends these authentication requirements to the protection of Controlled Unclassified Information (CUI) in non-federal systems.

Best practices for implementing the NIST password guidance

Aligning with SP 800-63B Rev. 4 requires changes to policy, tooling, and authentication infrastructure. The following practices address the most common gaps organizations face when moving from legacy policies to NIST-compliant ones.

Prioritize length over complexity

Complexity requirements make passwords harder to type and remember without meaningfully improving resistance to modern attacks. Keystroke logging, phishing, and credential stuffing succeed regardless of whether a password contains special characters. Set a minimum of 15 characters for single-factor authentication scenarios, build the block list, and remove complexity mandates.

Adopt a password manager

Enforcing 15-character-or-longer passwords without providing a password manager shifts the burden entirely onto users, increasing the risk of credential reuse across systems. Providing or mandating an enterprise password manager removes that obstacle and makes policy compliance straightforward.

Upgrade MFA before tightening password requirements

Organizations using SMS OTP to meet AAL2 requirements need to migrate to FIDO2/WebAuthn authenticators or TOTP apps. Planning the authenticator migration first prevents a gap period where neither control is fully effective. Reviewing identity and access management standards alongside SP 800-63B provides a fuller picture of the authentication assurance model.

Enforce least privilege alongside password policy

Password controls limit how credentials are created and managed, but they do not limit what a compromised credential can access. Applying the principle of least privilege to every account ensures that stolen credentials have a constrained blast radius.

How Netwrix helps you enforce NIST-aligned password policies

Netwrix Auditor delivers continuous visibility into authentication events and password change activity across hybrid Microsoft environments, generating audit-ready reports that map to NIST, HIPAA, PCI DSS, and SOC 2 requirements.

Netwrix Privilege Secure eliminates standing privileged accounts and enforces just-in-time access with phishing-resistant MFA and full session recording.

Netwrix Directory Manager enables users to reset passwords and unlock accounts through self-service workflows, maintaining policy enforcement without IT intervention.

Request a demo to see how Netwrix can help you align password policies with NIST SP 800-63B, eliminate standing credentials, and demonstrate compliance to auditors.