For years the advice was "at least 8 characters, with an uppercase letter, a digit and a symbol, changed every 90 days". The current US federal guideline, NIST SP 800-63B-4, finalised in 2025, throws most of that out.
What the guideline actually requires
For services that follow it:
- a password used on its own must be at least 15 characters,
- a password used together with a second factor may be shorter, but at least 8 characters,
- services should accept passwords of at least 64 characters,
- services must not impose composition rules (no "must contain a symbol"),
- services must not force periodic changes — only when there is evidence the password was compromised,
- new passwords must be checked against a list of common and breached ones.
The rules are written for the people who build login systems, but they are a good guide for anyone choosing a password too.
Why length beats complexity
What makes a password hard to guess is the number of possibilities an attacker has to try. That number grows with the size of the character set, but it grows much faster with length:
| Password | Possibilities | Strength in bits |
|---|---|---|
| 8 characters, all 94 printable | 94⁸ | about 52 |
| 12 characters, lowercase only | 26¹² | about 56 |
| 15 characters, lowercase only | 26¹⁵ | about 71 |
| 16 characters, all 94 printable | 94¹⁶ | about 105 |
Every extra bit doubles the work. A 15-character password made of lowercase letters alone is already over 250,000 times harder to brute-force than the "complex" 8-character one.
These numbers only hold for random passwords. Summer2026! has
11 characters from all four groups and is still one of the first things
an attacker tries.
Why forced changes were dropped
When people are made to change a password every few months, they change it
in predictable ways: Summer2026! becomes Autumn2026!. Attackers know this.
Regular resets made passwords weaker, not stronger, so the guideline now asks
for a change only after a breach.
What to do with this
- Use a password manager and let it create a unique, random password for every account — 16 characters or more costs you nothing when you never type it.
- For the few passwords you do type, use a long passphrase instead (more on that in the next guide).
- Turn on a second factor where you can. It matters more than any extra characters.
If you just need a random password right now, a browser-based generator such as Password Badger creates one on your own device, so it never travels over the network.