SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-nist-no-composition-rules

What does NIST SP 800-63B-4 say about password rules like requiring a mix of symbols, digits and capitals?

Verifiers must not impose such composition rules, and must not force periodic password changes.

Start playing free

  1. Do not impose composition rules ✔
  2. Require one of each character type
  3. Require a special character only

Why: Complexity rules push people toward predictable tricks like Password1!. NIST prefers length, blocklists and MFA. It also says not to force regular password changes without a reason.

Huh, didn't know that: NIST says the blocklist check must compare the entire password, not just words inside it.

The dad joke
I followed the old composition rules and ended up with 'Tr0ub4dor&3' and zero memory of it.
Like this card?
Play the game

References

Answer: Do not impose composition rules. Complexity rules push people toward predictable tricks like Password1!. NIST prefers length, blocklists and MFA. It also says not to force regular password changes without a reason.

  1. NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b-4.pdf
    SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords
    Checked 2026-10-10.
  2. NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b-4.pdf
    The entire password SHALL be subject to comparison, not substrings or words that might be contained therein.
    Checked 2026-10-10.
  3. NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b-4.pdf
    SHALL NOT require subscribers to change passwords periodically
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyUnder NIST SP 800-63B-4, what is the minimum length for a password used as the only authentication factor?Security & PrivacyYou sign in, and then the system decides which folders you may open. What is that second step?Security & PrivacyCapturing valid login data and sending it again later to impersonate a user is called what?

That's stuff everyone should know.