SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-nist-no-symbol-rules

What does current NIST guidance say about forcing symbols and capital letters in passwords?

Do not impose composition rules. Length matters more.

Start playing free

  1. Require one symbol and one capital
  2. Require them only for admins
  3. Do not impose composition rules ✔

Why: Forced rules push people to write Password1! style passwords that attackers already guess. NIST says verifiers should not impose them and should favor length instead.

Huh, didn't know that: NIST also says systems should permit a maximum password length of at least 64 characters.

The dad joke
My password is like me: weak, outdated, and easy to guess.
Like this card?
Play the game

References

Answer: Do not impose composition rules. Forced rules push people to write Password1! style passwords that attackers already guess. NIST says verifiers should not impose them and should favor length instead.

  1. NIST SP 800-63B Digital Identity Guidelines pages.nist.gov/800-63-4/sp800-63b.html
    SHALL NOT impose other composition rules
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyNIST says a password used as the only login factor should be at least how long?Security & PrivacyCISA says a strong business password should be at least how long?Security & PrivacyDoes NIST say companies should force staff to change passwords on a schedule?

That's stuff everyone should know.