NIST Password Guidelines: The Rules Now Prohibited

Most password policies in use today were written to an older idea of strength: mix the character types, rotate every 90 days, ask a security question. The current NIST password guidelines prohibit all three. This page sets out what the standard forbids, what it requires instead, and how far Microsoft Entra ID and Google Workspace let an administrator follow it.

The standard is SP 800-63B-4. NIST's publication record lists it as final, published in July 2025, replacing the 2020 edition. It also renames "memorized secrets" to plain "passwords".

What the NIST password guidelines prohibit

NIST uses "SHALL NOT" for a hard prohibition and "SHOULD" for a recommendation. Every row below is a hard prohibition from the section on password verifiers, which the document cross-references as section 3.1.1.2.

The reasoning on character mixes is given in the standard's appendix. A user who would have chosen "password" is, in NIST's words, "relatively likely to choose 'Password1'" when told to add a capital and a number. The rule changes the string and leaves it just as guessable.

The ban on scheduled changes has one condition attached. The same sentence continues: verifiers "SHALL force a change if there is evidence that the authenticator has been compromised". Dropping expiry is only half the instruction.

What NIST requires instead

Length replaces complexity, and the required length depends on whether the password stands alone.

Four more requirements sit beside the length rules:

• Blocklist. A new password must be compared against a list of "commonly used, expected, or compromised passwords", and the user must be told why a choice was rejected.
• Rate limiting. Failed attempts on one account must be capped at "no more than 100" in a row. NIST calls that an upper bound and allows lower limits.
• Password managers. Verifiers "SHALL allow the use of password managers and autofill", and should allow pasting.
• Show password. The sign-in form should offer to display the password while it is typed.

The standard is also plain about the limit of all this: "Passwords are not phishing-resistant." Length does nothing against a fake sign-in page, which is why mail authentication matters too; see what Google, Yahoo and Microsoft require for SPF, DKIM and DMARC.

Where Microsoft Entra ID differs

For cloud-only accounts, Microsoft's password policy page lists settings that, unless noted, "you can't change". Three of them conflict with NIST:

• Minimum length is 8, with a maximum of 256. There is no setting to raise the minimum to 15.
• Three of four character types are required: lowercase, uppercase, numbers and symbols.
• Unicode characters are not allowed.

The page states that "Password expiration is the only part of the policy that can be changed." Microsoft's own recommendations page advises a 14-character minimum, which the cloud policy cannot enforce.

On expiry, Microsoft agrees with NIST. The same recommendations page says the "recommended setting is for passwords to never expire", and the expiration policy page says passwords never expire by default. The Entra policy page adds a caveat: a tenant created before 2021 "has a 90 day expiration value by default".

The blocklist requirement is partly met. Microsoft's global banned password list applies to every tenant and cannot be switched off. Microsoft says it "isn't based on any third-party data sources, including compromised password lists", whereas NIST names breach lists as an example source. A custom list of up to 1,000 terms needs Entra ID P1 or P2.

Lockout is stricter than NIST asks. Smart lockout locks an account after 10 failed attempts by default, against NIST's ceiling of 100.

Where Google Workspace differs

Google gives the administrator more room. Its password requirements page allows a minimum and maximum length "between 8 and 100 characters", so a 15-character floor can be set.

The rest lines up with NIST:

• No character-mix quota. Google notes that a strong password "doesn't need to have a specific number of characters of a specific type".
• Breach check. A strong password is one that is "not in a database of breached accounts".
• Expiry off by default, "because research has shown little positive impact on security".

Two limits are worth knowing. Length and strength rules do not apply to passwords an admin resets by hand. Where single sign-on is in use, Google's advice is to turn password enforcement off, because the identity provider's policy governs instead.

How do Cyber Essentials and CISA compare?

Organisations outside the US federal government often work to a different yardstick. The UK's Cyber Essentials requirements, version 3.3, dated April 2026, accept any one of three options for password quality: multi-factor sign-in, a 12-character minimum, or an 8-character minimum with a deny list of common passwords. They also say not to enforce "regular password expiry" or "password complexity requirements".

The NCSC's password guidance reaches the same conclusions as NIST by a different route, stating that regular changing "harms rather than improves security". CISA's small-business page asks for at least 16 characters, and still describes a mix of character types as one way to make a password random.

Cyber Essentials sets a separate, lower bar for unlocking a device: a password or PIN of at least six characters. Enforcing that across laptops and phones is a device-management job, covered in MDM for small businesses compared by minimum order size.

Which settings can an admin change today?

The paths below are quoted from the vendors' documentation. They were read, not exercised in a live tenant; the methodology page explains that distinction.

1. Turn off scheduled expiry in Microsoft 365. In the admin center, open Settings, then Org Settings, then the Security and Privacy tab, then Password expiration policy. Tick "Set passwords to never expire (recommended)".
2. Check what your Microsoft tenant really does. Run Get-MgDomain to see the expiry value on each domain, since Microsoft's pages disagree on the default.
3. Add your own banned terms in Entra. Go to Entra ID, Authentication methods, Password protection, and set "Enforce custom list" to Yes. This needs P1 or P2.
4. Raise the minimum in Google Workspace. In the Admin console, go to Security, Authentication, Password management, and set the minimum length.
5. Write down the compromise process. NIST and Cyber Essentials both require a prompt change when a password is known or suspected to be exposed.

Who has to follow these rules

SP 800-63B-4 describes its own scope as "the authentication of subjects who interact with government information systems". It binds US federal agencies and their systems. A private company follows it by choice, or because a contract, insurer or auditor points to it.

Cyber Essentials is a certification scheme, so its password rules apply to organisations seeking that certificate. Neither document claims to bind a small private firm that has not signed up to it. What both offer is a published, reasoned baseline that a five-person company can copy without paying anyone.