Password Security in 2026: What NIST Actually Recommends

Most password rules you were taught are not merely outdated — they are explicitly contradicted by the current guidance from the organization that wrote the original rules. The US National Institute of Standards and Technology reversed course on mandatory complexity and periodic expiration years ago, on evidence that both push users toward predictable, weaker behavior. If your organization still forces a symbol and a quarterly reset, it is following advice its own source has retracted.

What NIST now says

The relevant document is NIST Special Publication 800-63B, the Digital Identity Guidelines covering authentication. Its headline positions, stated plainly:

• Length is the primary strength factor. Long passphrases beat short complex strings.
• Do not impose composition rules — requiring an uppercase letter, a digit and a symbol is discouraged, because it produces predictable substitutions like P@ssw0rd1.
• Do not force periodic expiration without cause. Rotate only when there is evidence of compromise. Forced resets cause incremental, guessable changes.
• Screen new passwords against lists of known-breached and commonly used credentials, and reject matches.
• Allow all printable characters, including spaces and emoji, and support long inputs — a minimum acceptance of 64 characters.
• Allow paste, and allow an optional reveal. Blocking paste breaks password managers, which are a net security gain.

Why length beats complexity, arithmetically

Password strength against guessing is measured in entropy, and entropy grows linearly with length but only logarithmically with alphabet size. Adding one character to a random password multiplies the search space by the size of the character set; adding symbols to the character set multiplies it once. Twelve random characters from a 62-character alphabet is around 71 bits of entropy; sixteen from a 26-letter alphabet is about 75 bits — the longer, simpler one is stronger.

The catch is the word random. A memorable sentence is not random, and attackers model human language well. This is why the practical recommendation splits in two: use a manager-generated random string wherever you never type it by hand, and use a long randomly-chosen multi-word passphrase where you must memorize it.

How attacks actually work

Understanding the threat clarifies which defenses matter. Credential stuffing is the dominant attack: attackers take username and password pairs from one breach and replay them against hundreds of other services, exploiting reuse. It requires no cracking at all. Offline cracking happens after a breach, when attackers hold password hashes and guess against them at enormous speed — hence why the site's hashing algorithm matters as much as your password. Phishing bypasses password strength entirely by getting you to type it into the wrong place. Password spraying tries a handful of very common passwords against many accounts to stay under lockout thresholds.

Notice that only one of those four is affected by how clever your password looks. Reuse and phishing are the real exposure, and both are addressed by structural habits rather than by adding an exclamation mark.

The five habits that actually protect you

• Never reuse a password across sites. This single habit neutralizes credential stuffing, the most common account-takeover method.
• Use a password manager. It makes unique, long, random passwords practical, and it resists phishing because it will not autofill on a look-alike domain.
• Turn on multi-factor authentication everywhere it is offered, preferring an authenticator app or a hardware security key over SMS, which is vulnerable to SIM-swap attacks.
• Prioritize your email account above all others. Whoever controls your email can reset most of your other passwords by design.
• Check your addresses against breach databases and change anything that appears, rather than rotating everything on a calendar.

Passkeys: where authentication is heading

The longer-term answer is to stop transmitting shared secrets at all. Passkeys, built on the W3C Web Authentication standard, use public-key cryptography: your device holds a private key, the site holds only a public key, and authentication is a cryptographic challenge tied to the site's origin. There is no reusable secret to steal, and phishing fails because the credential is bound to the real domain. Major platforms and browsers now support them broadly, and where a service offers a passkey, it is a straightforward upgrade over any password you could choose.

Protecting documents, not just accounts

Account security is only half the picture: the files themselves often carry the sensitive data. When you send a document containing personal or financial information, encrypt it with a strong open password and transmit the password over a different channel than the file. Text-level encryption is useful for the same reason when you need to pass a short secret through an insecure medium.

What to change this week

Concretely: adopt a password manager, generate fresh unique credentials for your email, banking and primary cloud accounts, enable app-based or hardware multi-factor authentication on those same accounts, replace passwords with passkeys wherever they are offered, and stop forcing calendar-based rotations if you administer a system. That list follows current national guidance and eliminates the attack paths that account for the overwhelming majority of real account compromises.

One closing note on tooling: a generated password should never be transmitted to a server. The generator on this site produces values in your browser using the platform's cryptographic random number source, so nothing you generate is ever sent anywhere.