For years, businesses were told that secure passwords needed uppercase letters, lowercase letters, numbers, symbols, and frequent resets. The current NIST password guidelines take a different approach.
Instead of forcing people to create complicated passwords they cannot remember, NIST emphasizes length, compromised-password screening, multi-factor authentication, and stronger protections behind the scenes.
Here are the most important requirements businesses should understand in 2026.
What Are the 2026 NIST Password Guidelines?
The guidelines commonly referred to as the “2026 NIST password guidelines” come from NIST Special Publication 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management. NIST finalized the publication on July 31, 2025, replacing the previous version of SP 800-63B. It remains the standard businesses follow in 2026.
The guidelines were created primarily for federal digital identity systems. However, private businesses, technology providers, cybersecurity professionals, and compliance teams frequently use NIST guidance as a benchmark for building stronger authentication policies.
The main changes are not about making passwords harder to create. Instead, they focus on using longer passwords, blocking weak ones, avoiding unnecessary password resets, and using MFA when extra security is needed.
2026 NIST Password Length Requirements
The password length requirement depends on whether the password is used on its own or as part of multi-factor authentication.
Minimum Password Length
NIST requires passwords used as the sole authentication factor to be at least 15 characters long.
When a password is used as part of an MFA process, NIST allows the minimum to be reduced to eight characters.
This difference is important:
- Password-only login: Minimum of 15 characters
- Password used with MFA: Minimum of eight characters
Organizations may still ask for longer passwords, especially for admin accounts, remote access, or systems with sensitive data.
Maximum Password Length and Passphrases
NIST says systems should support passwords that are at least 64 characters long. This does not mean employees need to create 64-character passwords. It means the system should not prevent someone from using a long password or passphrase.
For example, a user may find a longer passphrase easier to remember than a shorter password filled with random symbols.
A passphrase, such as several unrelated words, can be both long and memorable. The specific phrase must be unique and should not include common sayings, song lyrics, company names, or personal information that someone could easily guess.
Systems should also allow:
- Spaces
- Printable characters
- Unicode characters when supported
- The complete password without silently cutting off characters
Longer passwords are harder for attackers to guess or crack, especially if they are stored securely.
NIST Does Not Recommend Routine Forced Password Changes
NIST advises organizations not to require employees to change their passwords on a set schedule.
That means businesses should reconsider policies requiring password changes every 30, 60, or 90 days. NIST only requires a password change when there is evidence that the password or account has been compromised.
Frequent resets can create new security problems. Employees may respond by:
- Making small, predictable changes to an old password
- Reusing passwords across multiple accounts
- Writing passwords down
- Choosing weaker passwords that are easier to remember
- Adding a new number to the end each time a reset is required
For example, a password like CompanyName1! might just become CompanyName2! after a reset. This meets old password rules but does not really make accounts safer.
Passwords should still be changed when:
- A password appears in a known data breach
- An account shows signs of unauthorized access
- Malware may have captured login credentials
- A user entered credentials into a phishing site
- An employee shared a password with someone else
- An administrator believes the credential may no longer be secure
The goal is not to keep passwords forever. It is to change them when there is a valid security reason.
Password Complexity Rules NIST Says to Avoid
NIST no longer suggests requiring passwords to include a mix of uppercase and lowercase letters, numbers, and symbols.
In fact, the guidelines say organizations should not impose these types of password composition rules.
A password does not automatically become strong because someone changes an “a” to “@” or adds an exclamation point. Attackers and password-cracking tools already know these common patterns.
For example, a password like P@ssword2026! might meet old complexity rules but is still easy to guess.
NIST places greater value on:
- Password length
- Unique passwords for every account
- Blocking commonly used passwords
- Detecting compromised credentials
- Limiting failed login attempts
- Protecting accounts with MFA
NIST also says organizations should not use password hints or knowledge-based security questions such as “What was the name of your first pet?” These answers may be easy to find online, guess, or obtain through social engineering.
Block Common and Compromised Passwords
Password length alone is not enough.
When someone creates or changes a password, NIST requires the organization to compare it against a blocklist containing commonly used, predictable, or previously compromised passwords.
The blocklist may include:
- Passwords exposed in previous data breaches
- Common dictionary words
- Frequently used passwords
- The employee’s username
- The name of the company or service
- Predictable variations of those words
For example, a 16-character password based entirely on the company name may technically meet the length requirement but still be easy to guess.
If a password is rejected, the system should explain why and ask the user to pick a stronger one. It should not just show a vague error message.
Businesses can meet this requirement by using identity platforms, password-policy tools, or compromised-credential monitoring services that check new passwords against known breach data.
How MFA Fits Into the 2026 NIST Guidelines
Passwords are not considered phishing-resistant. Even a strong password can be stolen through a convincing phishing email, a fake Microsoft 365 login page, malware, or credential reuse.
Multi-factor authentication adds another layer by requiring more than one type of proof. The factors generally include:
- Something you know, such as a password
- Something you have, such as a phone or security key
- Something you are, such as a fingerprint or facial scan
This is also why NIST allows a shorter password minimum when the password is part of an MFA process.
Does NIST Require MFA?
NIST does not require MFA for every possible account or authentication scenario.
At Authentication Assurance Level 1, single-factor authentication is allowed, although offering MFA is recommended.
Authentication Assurance Level 2 requires two distinct authentication factors. Applications operating at AAL2 must also offer a phishing-resistant authentication option. Authentication Assurance Level 3 has even stricter requirements and requires phishing-resistant authentication.
For most businesses, MFA should be prioritized for:
- Email accounts
- Microsoft 365 and Google Workspace
- Remote access and VPNs
- Cloud applications
- Financial systems
- Administrator accounts
- Password managers
- Systems containing customer or employee information
Not All MFA Methods Provide Equal Protection
Text messages and one-time authentication codes can improve security, but they can still be intercepted or entered into a fraudulent login page.
Phishing-resistant options provide stronger protection because the authentication process is tied to the legitimate website or service.
Examples may include:
- Passkeys
- FIDO2 hardware security keys
- Properly configured WebAuthn authentication
- Device-based cryptographic authenticators
Businesses do not necessarily need to replace every authentication method immediately. However, higher-risk users and privileged accounts should be moved toward stronger, phishing-resistant options whenever practical.
Allow Password Managers, Autofill, and Pasting
NIST says systems must allow password managers and autofill functionality. Systems should also permit users to paste passwords when autofill is unavailable.
Blocking the paste function does not make an account safer. It often encourages users to create passwords that are shorter, simpler, and easier to type.
A business password manager can help employees:
- Generate long, random passwords
- Use a unique password for every account
- Avoid keeping passwords in spreadsheets or documents
- Share business credentials more securely
- Identify reused or compromised passwords
- Remove access when an employee leaves the company
The password manager itself should be protected with a strong master password and MFA.
Protect Passwords Behind the Scenes
Employees only control part of the password-security process. The organization and its technology providers must protect passwords after they are submitted.
NIST says passwords should be transmitted through authenticated, encrypted connections. Stored passwords must also be salted and hashed using an appropriate password-hashing method rather than saved as readable plain text.
Organizations should also rate-limit failed login attempts. Rate limiting slows or blocks repeated guesses against an account, making automated attacks less effective.
Important technical protections include:
- Secure password hashing
- Unique salts
- Encrypted connections
- Failed-login rate limiting
- Account monitoring
- Compromised-password screening
- Secure password-reset and account-recovery procedures
These controls are usually managed by the identity provider, software developer, cloud platform, or IT team rather than the individual employee.
What Businesses Should Do to Follow the Guidelines
Businesses do not need to rebuild their entire IT environment overnight. Start by reviewing the policies employees interact with every day.
A practical NIST password-policy review should include the following:
- Increase the minimum password length. Require at least 15 characters for password-only accounts. When MFA is required, the minimum may be eight characters, although businesses can still set a longer standard.
- Remove unnecessary expiration rules. Stop forcing routine password changes unless another regulation or contractual requirement specifically requires them.
- Remove rigid composition requirements. Do not depend on uppercase letters, symbols, and numbers as the primary measure of password strength.
- Screen for compromised passwords. Block common, predictable, and previously breached credentials.
- Enable MFA. Begin with email, remote access, administrator accounts, cloud platforms, and sensitive business systems.
- Allow password managers. Make it easier for employees to generate and store unique credentials.
- Review older applications. Legacy systems may have short password limits, block special characters, prevent pasting, or lack MFA support.
- Prepare for compromised credentials. Create a clear process for resetting passwords, revoking sessions, reviewing account activity, and investigating suspicious access.
Businesses should also check whether industry-specific regulations, cyber insurance requirements, customer contracts, or vendor standards impose additional password rules. NIST provides a strong foundation, but it may not be the only standard that applies.
Frequently Asked Questions About the 2026 NIST Password Guidelines
How long should a password be according to NIST?
A password used as the only authentication factor must be at least 15 characters. A password used as part of MFA may be as short as eight characters.
Does NIST require passwords to expire?
No. NIST says organizations should not require routine password changes. A password should be changed when there is evidence that it has been compromised.
Does NIST require special characters?
No. NIST says organizations should not impose password composition rules requiring specific combinations of uppercase letters, lowercase letters, numbers, or symbols.
Does NIST require MFA?
It depends on the required Authentication Assurance Level. AAL1 permits single-factor authentication. AAL2 and AAL3 require two distinct authentication factors, with phishing-resistant options required at the higher assurance levels.
Are password managers allowed under NIST guidelines?
Yes. NIST says organizations must allow password managers and autofill. Systems should also allow passwords to be pasted when autofill is unavailable.
Is a long password enough to protect an account?
No. A long password can still be weak if it is commonly used, predictable, reused, or already exposed in a data breach. Strong authentication also requires compromised-password screening, secure storage, login-attempt limits, and MFA where appropriate.
Strengthen Your Organization’s Password and MFA Policies
The 2026 NIST password guidelines move businesses away from complicated rules that create frustration without providing enough protection.
The main priorities are straightforward:
- Use longer passwords
- Stop unnecessary forced password changes
- Block common and compromised credentials
- Allow password managers
- Enable MFA
- Move higher-risk accounts toward phishing-resistant authentication
BCA can help your organization review its existing password requirements, identity platforms, MFA settings, and account-security practices. A password-policy assessment can identify outdated rules, unsupported systems, and gaps that may leave business accounts vulnerable.
