Using a mixture of character types in your passwords and regularly changing passwords are officially no longer best password management practices according to new guidelines published by the US National Institute of Standards and Technology (NIST).
In NIST’s latest version of its Password Guidelines, the leading security standards organization suggested credential service providers (CSPs) stop recommending passwords using several character types and to stop mandating periodic password changes unless the authenticator has been compromised.
Additionally, NIST required CSPs not to use knowledge-based authentication (KBA) or security questions when choosing passwords.
These decisions formalize principles that public and private organizations like the US Federal Trade Commission and Microsoft have long recommended.
Good Passwords Between 15-64 Characters
The latest guidelines still require passwords to be at least eight characters.
Other notable recommendations include:
- Passwords should be of a minimum of 15 characters
- CSPs should allow passwords of a maximum of at least 64 characters
- CSPs should allow ASCII and Unicode characters to be included in passwords
The new guidelines were published in September 2024 as part of NIST’s second public draft of SP 800-63-4, the latest version of its Digital Identity Guidelines.
The previous version of NIST’s Password Guidelines was published in 2020.
Read more: Five Ways to Dramatically Reduce the Risk of Password Compromise