SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-nist-password-length-15

Under NIST SP 800-63B-4, what is the minimum length for a password used as the only authentication factor?

15 characters. If a password is only part of MFA, the minimum drops to eight.

Start playing free

  1. 8 characters
  2. 12 characters
  3. 15 characters ✔

Why: NIST now favors longer passwords over fancy rules. A password used alone must be at least 15 characters. When it is only one piece of multi-factor authentication, eight is the minimum.

Huh, didn't know that: NIST says verifiers should allow a maximum password length of at least 64 characters.

The dad joke
The longest password I ever made was so long, my keyboard asked for a vacation.
Like this card?
Play the game

References

Answer: 15 characters. NIST now favors longer passwords over fancy rules. A password used alone must be at least 15 characters. When it is only one piece of multi-factor authentication, eight is the minimum.

  1. NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b-4.pdf
    SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length
    Checked 2026-10-10.
  2. NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b-4.pdf
    SHALL require them to be a minimum of eight characters in length
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhat does NIST SP 800-63B-4 say about password rules like requiring a mix of symbols, digits and capitals?Security & PrivacyYou sign in, and then the system decides which folders you may open. What is that second step?Security & PrivacyCapturing valid login data and sending it again later to impersonate a user is called what?

That's stuff everyone should know.