SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-password-composition-rules

What does current NIST guidance say about password composition rules?

Verifiers should not require mixtures of character types.

Start playing free

  1. Require four character types
  2. Require a symbol every time
  3. Do not impose composition rules ✔

Why: People respond to rigid rules predictably, such as adding 1 and an exclamation point. NIST instead emphasizes length, blocklists, secure storage, and rate limiting.

Huh, didn't know that: NIST also says services should allow password managers and paste functions.

The dad joke
The symbol demanded special treatment, but the verifier declined.
Like this card?
Play the game

References

Answer: Do not impose composition rules. People respond to rigid rules predictably, such as adding 1 and an exclamation point. NIST instead emphasizes length, blocklists, secure storage, and rate limiting.

  1. NIST SP 800-63B pages.nist.gov/800-63-4/sp800-63b.html
    Verifiers and CSPs SHALL NOT impose other composition rules
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich password property most directly increases resistance to guessing?Security & PrivacyWhat should a service check when a user creates a password?Security & PrivacyWhich three goals form the CIA triad?

That's stuff everyone should know.