Strength of Passwords - NIST
...Many attacks associated with passwords are not affected by password complexity and length. Keystroke logging, phishing, and social engineering attacks are equally effective on lengthy and complex passwords as they are on simple ones....
https://pages.nist.gov/800-63-4/sp800-63b/passwords/
NIST Special Publication 800-63B
...Stronger authentication (a higher AAL) requires malicious actors to have better capabilities and expend greater resources in order to successfully subvert the authentication process. Authentication at higher AALs can effectively reduce the risk of attacks....
https://pages.nist.gov/800-63-3/sp800-63b.html
How Do I Create a Good Password? | NIST
...As new ways to verify your identity have emerged, cybersecurity experts at NIST encourage you to avoid relying on passwords whenever possible. But passwords seem inescapable. What should you do when you are required to create one? NIST maintains digital identity guidelines....
https://www.nist.gov/cybersecurity-and-privacy/how-do-i-create-good-password
The Complete Guide to NIST Password Guidelines
...Stay secure in 2025 with NIST?s updated password guidelines. Learn the latest best practices for strong, effective password policies....
https://drata.com/learn/nist/password-guidelines
Easy Ways to Build a Better P@$5w0rd | NIST
...While the math of what makes a strong password hasn?t changed in theory, data from the past several years has revealed much about how people think about and cope with computer security. It was these human factors that served as the foundation for our recommendations....
https://www.nist.gov/blogs/taking-measure/easy-ways-build-better-p5w0rd
NIST Recommends New Rules for Password Security
...NIST now recommends a minimum password length of 8 characters, with a strong preference for even longer passwords. Organizations are advised to allow passwords up to at least 64 characters to accommodate passphrases....
https://cybersecuritynews.com/nist-rules-password-security/
NIST Changed the Rules on Passwords: Is Your Organization Still ...
...Quick answer: NIST SP 800-63B Revision 4, finalized July 31, 2025, now requires passwords to be at least 15 characters, checked against breach databases, and changed only when compromised....
https://cyberunit.com/insights/nist-password-guidelines-2026-update/
NIST SP 800-63B Password Guide 2026 ? Entropy & Passphrase
...This article covers what NIST SP 800-63B actually recommends, the mathematics of password entropy, the zxcvbn algorithm that powers realistic strength evaluation, and the practical hierarchy of authentication security in 2024....
https://toolsbase.dev/en/blog/nist-password-strength-guide
NIST Password Guidelines: 2026 Updates & Best Practices
...Password security remains the foundation of digital access control, with 94% of data breaches involving compromised credentials. The National Institute of Standards and Technology sets the benchmark for password security through its Special Publication 800-63B....
https://www.strongdm.com/blog/nist-password-guidelines
NIST Password Guidance For Strong Passwords - Intrust IT
...Learn how NIST password guidance helps businesses improve security using longer passwords, MFA and password managers....
https://www.intrust-it.com/nist-password-guidance/