Quick answer: Favor long, unique passwords, screen out known compromised choices, and use stronger authentication. Routine rotation and forced character mixtures can create predictable user behavior rather than meaningful protection.
What changed since the original article?
The original 2022 discussion proposed a compromise around longer passphrases and less frequent rotation. This update removes the blanket recommendation for yearly rotation and mandatory complexity rules, and replaces reusable password examples with practical policy considerations.
Current NIST context
NIST SP 800-63B-4 sets a 15-character minimum for single-factor passwords; passwords used only within MFA may be as short as eight characters. It rejects mandatory character-mix rules and routine periodic changes, requires a change upon evidence of compromise, and calls for screening against common, expected, or compromised passwords. These requirements concern the authentication processes in scope for the guidance, not every local device-unlock PIN.
Make your policy usable in practice
- Start with the real sign-in journey. Document where users must remember a password and where an approved password manager can help.
- Avoid predictable patterns. A longer phrase built from a company name, current year, or published example may still be easy to guess.
- Plan account recovery. Test how a user regains access after losing a device without creating an easy bypass.
- Check legacy dependencies. Validate application behavior, directory settings, and service-account requirements before rolling out changes.
- Train before rollout. Give staff clear instructions and test the support process with a small group.
Review Active Directory settings deliberately
Password history, minimum age, and length limits interact with operational needs and application compatibility. Do not copy a universal value without evaluating your environment. Keep reversible password encryption disabled unless a documented legacy requirement has been assessed and accepted; it permits recovery of password material and is materially different from one-way password hashing.
Frequently asked questions
Should users change passwords on a fixed schedule?
NIST SP 800-63B-4 says verifiers should not require periodic password changes, but must force a change when there is evidence of compromise. Other applicable requirements may affect your policy.
Do character-mix rules guarantee a strong password?
No. Predictable substitutions and reused patterns can remain weak. Prioritize length, uniqueness, screening of compromised passwords, and stronger authentication.
Reference
NIST SP 800-63B-4: Authentication and Authenticator Management
