NIST 2026 Password Requirements: What's Changed

NIST SP 800-63B standards: what has changed

The US National Institute of Standards and Technology (NIST) has revised its password guidelines. Many of the usual rules turned out to be counterproductive.

Major changes

1. Length is more important than complexity

**Old approach**: minimum 8 characters, numbers, special characters, mixed case required.

**New NIST**: minimum 8 characters, but **15+ recommended**. Complexity is not required if the password is long enough.

Why? “Tr0ub4dor&3” is easier to crack using brute force than “correct horse battery staple” (32 characters, memorized).

2. No forced rotation

**Old approach**: change your password every 90 days.

**New NIST**: change password **only if compromised**. Forced rotation forces the use of weak, predictable passwords (Password1! → Password2! → Password3!).

3. Prohibition of hints and “secret questions”

Hints and questions (mother's maiden name, pet's name) are easily guessed through social networks.

4. Checking against leak databases

When creating a password, you need to check it against the database of known leaks (Have I Been Pwned). Compromised passwords are prohibited.

5. No restrictions on characters

All Unicode characters are allowed, including spaces and emoji.

Practical recommendations

Types of password attacks

Create a strong password

Password generator creates cryptographically random passwords of any length and composition.

See also: Password Strength Checker, Hash Generator, UUID Generator