SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-nist-15-chars

NIST says a password used as the only login factor should be at least how long?

15 characters when the password is the only factor.

Start playing free

  1. 8 characters
  2. 15 characters ✔
  3. 20 characters

Why: When a password stands alone, NIST asks for a longer minimum because nothing else backs it up. With multi-factor authentication in place, the minimum drops to eight.

Huh, didn't know that: NIST also says systems should accept spaces and all printing ASCII characters in passwords.

The dad joke
I got locked out of my account. Apparently, 'letmeinplease' isn't secure.
Like this card?
Play the game

References

Answer: 15 characters. When a password stands alone, NIST asks for a longer minimum because nothing else backs it up. With multi-factor authentication in place, the minimum drops to eight.

  1. NIST SP 800-63B Digital Identity Guidelines pages.nist.gov/800-63-4/sp800-63b.html
    to be a minimum of 15 characters in length
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhat does current NIST guidance say about forcing symbols and capital letters in passwords?Security & PrivacyCISA says a strong business password should be at least how long?Security & PrivacyDoes NIST say companies should force staff to change passwords on a schedule?

That's stuff everyone should know.