Password Policy Recommendations: Strength, Length, and Rotation

Password Policy Has Evolved. Are Your Policies Current?

Password best practices have shifted significantly in recent years. NIST's updated Digital Identity Guidelines (SP 800-63B) and Microsoft's own security recommendations have moved away from several long-held conventions that are now understood to make passwords less secure rather than more.

What NIST Now Recommends

• Minimum length of at least 8 characters — but 12–16 is significantly better; passphrases of 20+ characters are excellent
• Do NOT require regular rotation — Mandatory periodic changes (90-day cycles) cause users to make small, predictable changes and actually reduce security
• DO require changes on evidence of compromise — If a credential appears in a breach dataset or is suspected compromised, require an immediate change
• Screen against known compromised passwords — Check new passwords against breach datasets and your custom banned list
• Allow all printable characters — Don't artificially restrict special characters
• No complexity requirements that reduce entropy — Requiring "at least one uppercase, lowercase, number, and symbol" often results in predictable patterns like "Password1!" that crack immediately

What Pentest Experience Confirms

In internal penetration tests, the most commonly cracked passwords share a pattern: they meet complexity requirements but are variations on predictable patterns. "Company2024!", "Summer23", "[City]P@ss" — these crack immediately in targeted attacks. Length is far more valuable than mandatory complexity.

Multi-Factor Authentication Is Not Optional

No password policy fully compensates for the absence of MFA. Even strong, unique passwords can be captured via phishing or keyloggers. MFA — particularly TOTP authenticator apps or hardware tokens — provides a critical secondary layer that password policy alone cannot.