Home / Guides / NIST's 2025 Password Rule Change
NIST's 2025 Password Rule Change
The decades-old advice to mix uppercase, symbols, and numbers, and change your password every 90 days, is now explicitly outdated. Here's what the actual federal guidance says instead.
What changed
In August 2025, NIST finalized Special Publication 800-63B Revision 4, the federal government's Digital Identity Guidelines and the reference standard most password policies, inside and outside government, end up following sooner or later. It replaces the version published in 2020. The changes to password rules are substantial enough that a policy written to the old version is now out of step with current best practice.
The four changes that matter
- Length over complexity. A password used as the sole authentication factor should be at least 15 characters. Paired with another factor (like an authenticator app), 8 characters is the floor. Systems must support at least 64 characters and accept the full range of printable ASCII and Unicode, including spaces.
- No mandatory composition rules. Systems should not require a specific mix of uppercase, lowercase, numbers, and symbols. These rules push people toward predictable patterns (capitalizing the first letter, adding "1!" at the end) that attackers' cracking tools already account for.
- No forced periodic rotation. Passwords should only be changed when there's evidence of compromise, not on a fixed calendar. Forced rotation reliably produced weaker passwords, as people made small, guessable variations on their previous one.
- Mandatory blocklist screening. New passwords should be checked against lists of known-compromised and commonly-used passwords at the point of creation, and rejected if they match.
Why the change
The consistent finding across each revision of this guidance has been the same: composition rules and forced rotation produce worse security outcomes in practice, because they push predictable human behavior rather than genuine randomness. A truly random 15-character password is dramatically harder to guess than an 8-character password built from required character categories. The old rules optimized for the appearance of complexity, not actual unpredictability. That's also part of why this site's own password generator defaults toward length and full randomness rather than forcing you to include specific character types.
Where this shows up on this site
The Password panel flags whether a generated password meets the 15-character single-factor guidance. The Password Checker applies the same standard to a password you already have, and also screens against a small list of extremely common passwords, a lightweight version of the blocklist screening NIST now recommends.
Frequently asked questions
Does this mean I should stop using complex passwords?
No, a long password with mixed characters is still fine. What changed is that systems should no longer force specific composition rules, like requiring a symbol, because those rules push people toward predictable patterns. Length is what actually matters most.
Should I still change my passwords every 90 days?
NIST's current guidance says no. For personal, non-privileged accounts, only change a password when there's actual evidence it's been compromised. Some organizations still require periodic rotation for privileged or administrative accounts as an added layer, but that's now the exception rather than the default best practice.
- NIST SP 800-63B Revision 4, Digital Identity Guidelines: Authentication and Authenticator Management (finalized July 31, 2025), csrc.nist.gov
- NIST, publication landing page with full citation, nist.gov