For years, password rules meant at least eight characters with an uppercase letter, a number and a symbol, changed every 90 days. That advice produced passwords like Summer2024! and very little actual security. The official U.S. guidance has since gone the other way: longer, no forced complexity, no scheduled changes.
This article covers what NIST's current guidelines actually require, why length beats complexity, and how long a password or passphrase needs to be in practice.
What NIST says now
The U.S. National Institute of Standards and Technology publishes the digital identity guidelines that many organizations, including U.S. federal agencies, follow for logins. The current version, SP 800-63B-4, was finalized in July 2025. Its password rules (section 3.1.1) say:
- At least 15 characters when the password is the only thing protecting the account.
- At least 8 characters when the password is used together with a second factor, such as an authenticator app or security key.
- Allow at least 64 characters, so people can use long passphrases.
- No composition rules. Sites "SHALL NOT" require a mix of character types.
- No scheduled changes. Sites shall not force periodic password changes, but they must force a change when there's evidence the password has been compromised.
- Check against a blocklist of commonly used, expected or compromised passwords, and reject matches.
- Accept spaces and Unicode, allow password managers and autofill, and let people paste.
- No password hints and no security questions.
These are requirements for the services that check passwords, not for you personally. But they're the best available summary of what actually makes a password hard to guess.
Why length beats complexity
Strength comes from how many possibilities an attacker has to try. For a randomly generated password, that's the number of possible characters raised to the power of the length, usually written in bits: each bit doubles the search space.
Adding character types helps a little. Adding length helps a lot. Using the same math as our Password Generator, with 87 possible characters when all four types are on:
| Random password | Bits | Time to try half of all options* |
|---|---|---|
| 8 characters, all four types | 51.5 | About 2 days |
| 12 characters, all four types | 77.3 | About 2,981 centuries |
| 15 characters, lowercase only | 70.5 | About 27 centuries |
| 15 characters, all four types | 96.6 | Longer than the age of the universe |
| 20 characters, lowercase only | 94.0 | Longer than the age of the universe |
*Assuming a fast offline attack testing 10 billion guesses per second, the model the Password Generator uses for its estimates. Real attack speed depends heavily on how the site stored the password, which is covered below.
A random 20-character password of lowercase letters alone outlasts an 8-character password with every character type by a wide margin. Length is also much easier on people: there's no fiddly symbol to remember, and it's easier to type on a phone.
Why "complex" human passwords are weak anyway
The math above only applies to random passwords. Passwords people make up follow patterns, and attackers try those patterns first: a capitalized word, a year, an exclamation point at the end, a swapped for @. The Password Generator's checker shows this. It rates Summer2024! at just 25 bits and flags three problems: it contains a common word ("summer"), years are easy to guess, and 11 characters is too short. P@ssw0rd123 scores 0 bits, because it's one of the most common passwords with a few predictable substitutions.
Composition rules push people toward exactly these patterns, which is why NIST dropped them. A blocklist of known passwords catches far more weak choices.
Passphrases: how many words?
A passphrase is several random words, like lazy-alter-open-flower-amused-idea, which the Password Generator produced. It's long, easy to type and easier to remember than random characters. But its strength comes from the number of words and the size of the word list, not from the number of letters.
The Password Generator picks words from the 2,048-word BIP39 English list, so each word adds 11 bits:
| Random words | Bits | Time to try half of all options* |
|---|---|---|
| 4 | 44 | About 15 minutes |
| 5 | 55 | About 21 days |
| 6 | 66 | About 1 century |
| 7 | 77 | About 2,396 centuries |
A four-word passphrase is usually well over 15 characters, yet it's weaker than a random 12-character password against a fast offline attack. So the 15-character minimum is a floor, not a strength guarantee. For a passphrase you rely on, use at least six random words. The words must be chosen randomly by software or dice. A phrase you make up yourself, like a song lyric, follows patterns attackers can exploit.
How the site stores your password matters too
The "10 billion guesses per second" figure is a worst case: a stolen database where passwords were hashed with a fast algorithm. If the site uses a deliberately slow password hash like Argon2id or bcrypt, each guess costs the attacker far more, and the same password lasts much longer. Our article on MD5 vs SHA-256 vs bcrypt explains why, and the Bcrypt Generator shows how quickly the cost grows with each step.
Online attacks, where someone types guesses into a login form, are much slower, because sites limit attempts. NIST requires services to limit failed attempts as well. That's why an 8-character password can still be acceptable when it's paired with a second factor: an attacker who guesses it still can't get in.
You can't control how a site stores passwords, so plan for the worst case on accounts that matter.
Practical recommendations
- Use a password manager and let it generate a random password of 16 characters or more for every account. You don't need to remember them.
- Memorize only a few passphrases: the one for your password manager, your computer and your main email. Make them six or more random words.
- Never reuse passwords. When one site leaks, attackers try the same email and password everywhere else. Reuse turns one breach into many.
- Turn on two-factor authentication, preferably an authenticator app, a security key or a passkey, on email, banking and anything that can reset other accounts.
- Change a password when there's a reason: a breach notice, a suspicious login, or having typed it on a device you don't trust. Not on a calendar.
If you run a website
The NIST rules translate into a short checklist for your sign-up form:
- Require at least 15 characters if the password is the only factor, or 8 if you enforce a second factor.
- Allow at least 64 characters, spaces and Unicode, and never silently truncate.
- Drop the "one uppercase, one number, one symbol" rules and drop forced expiry.
- Reject passwords found on lists of common and breached passwords, and tell the user why.
- Allow pasting and password managers.
- Store passwords with a slow, salted password hash.
FAQ
Is a 12-character password enough?
A random 12-character password using all character types is about 77 bits, which is strong. NIST's 15-character minimum for single-factor logins adds margin, and a password manager makes the extra length free.
Are symbols still worth adding?
They add a little strength to random passwords, but length adds more. If a site rejects certain symbols, just make the password longer.
Do I need to change my passwords regularly?
No. NIST says services shouldn't require periodic changes. Change a password when there's evidence it was exposed.
What does "bits of entropy" mean?
It's the number of yes-or-no choices needed to describe all possible passwords of that kind. Each extra bit doubles the number of guesses an attacker might need. It only applies to randomly generated passwords.
