How Long Should a Password Be? What NIST Recommends

What NIST requires

NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Authenticator Management, is the document US federal systems follow and most of the industry quotes. Revision 4 was published as final in July 2025. Its password section is written as requirements for verifiers, the systems that check passwords, and the length rules read:

Verifiers shall require passwords used as a single-factor authentication mechanism to be a minimum of 15 characters.
Verifiers may allow passwords used only as part of multi-factor authentication to be shorter, but shall require a minimum of eight characters.
Verifiers should permit a maximum password length of at least 64 characters.
Verifiers should accept all printable ASCII characters and the space, and should accept Unicode; each Unicode code point counts as one character.

So for an account protected by a password alone, 15 characters is the floor a compliant service must enforce. Where you also use an authenticator app or a security key, the password can be shorter because it is no longer the only thing standing in the way.

What NIST tells services not to do

No composition rules. Verifiers shall not impose other composition rules, such as requiring mixtures of different character types. The obligatory capital letter, digit and symbol are out.
No scheduled changes. Verifiers shall not require subscribers to change passwords periodically, and shall force a change if there is evidence the password has been compromised.
No hints, no security questions. Verifiers shall not let you store a hint accessible to an unauthenticated visitor, and shall not prompt you to use knowledge-based authentication when choosing a password.
No blocking of password managers. Verifiers shall allow the use of password managers and autofill, and should permit pasting a password.
No truncation. Verifiers shall verify the entire submitted password.

And three things they must do: compare a new password against a blocklist of commonly used, expected or compromised passwords; limit the number of failed attempts with rate limiting; and store passwords salted and hashed with a suitable password hashing scheme, with a salt of at least 32 bits and a cost factor as high as practical. The hash generator shows what a hash is and why a fast hash such as MD5 or SHA-1 is the wrong tool for passwords.

Why length beats complexity

NIST's Appendix A puts it in one sentence: password length is a primary factor in characterizing password strength. The reason is multiplication. A password of L characters, each chosen at random from a set of N, has N^L possibilities, and the usual way to express that is in bits:

Entropy of a random password

bits = length × log₂(characters to choose from)

Each extra character adds the same number of bits regardless of where it sits; widening the character set adds less than it looks. The table gives the bits for each combination, assuming every character is chosen at random. A password you made up yourself has fewer, because people do not choose at random.

Characters drawn from	8 chars	12 chars	15 chars	16 chars	20 chars	24 chars
lowercase letters (26)	38 bits	56 bits	71 bits	75 bits	94 bits	113 bits
lowercase and digits (36)	41 bits	62 bits	78 bits	83 bits	103 bits	124 bits
upper, lower and digits (62)	48 bits	71 bits	89 bits	95 bits	119 bits	143 bits
all 95 printable ASCII characters (95)	53 bits	79 bits	99 bits	105 bits	131 bits	158 bits

Read across and down: 12 lowercase letters (56 bits) beat 8 characters from the whole keyboard (53 bits), and 16 lowercase letters (75 bits) beat 12 from the whole keyboard (79 bits). That is the arithmetic behind NIST's finding that composition rules deliver less than expected: users respond to them in very predictable ways, a capital at the start, a digit and an exclamation mark at the end, which attackers' tools try first.

What the bits mean in time depends entirely on how fast the attacker can guess, which depends on how the password was stored. At an assumed 1 × 10^10 guesses per second, the rate of an offline attack on a fast hash, the expected time to find a password is half the possibilities divided by the rate:

Password	Bits	Expected time at 10 billion guesses a second
8 characters, any of 95	53	4 days
12 lowercase letters	56	55 days
15 characters, upper, lower and digits	89	1.2 × 10^9 years
16 characters, any of 95	105	7.0 × 10^13 years
20 characters, any of 95	131	5.7 × 10^21 years

Against a service that rate-limits online attempts, as NIST requires, even the first row holds for a long time. Against a stolen database hashed badly, it falls in a day. You do not know which case you are in, which is why the password itself should be long.

Passphrases

A passphrase is several words in a row. NIST calls passphrases often an effective way to create a longer password, and the 64-character minimum and the acceptance of spaces exist to make room for them. The strength comes from the number of words and the size of the list they are drawn from, not from the words looking unusual. For a list of 7,776 words, which is 6⁵, the size of a list you can index with five dice:

Random words	Bits	Typical length	Expected time at 10 billion guesses a second
3	39	about 17 characters	under a day
4	52	about 23 characters	2 days
5	65	about 29 characters	45 years
6	78	about 35 characters	350,270 years
7	90	about 41 characters	2.7 × 10^9 years
8	103	about 47 characters	2.1 × 10^13 years

Four random words already clear 50 bits and 15 characters; six words pass 75 bits and are still easy to type on a phone. The condition is in the word "random": the words have to come from dice or a generator, not from your head. The passphrase mode of the password generator picks them with the browser's cryptographic random number generator, and the password strength checker estimates the bits of anything you paste into it, locally, without sending it anywhere.

What to do

Use a password manager and let it generate 20 or more random characters for every account. Length is free when you do not have to type it.
For passwords you type, use a passphrase of five or six random words. It meets NIST's 15-character floor with room to spare and is faster to enter than 16 symbols.
Never reuse a password. The blocklist NIST requires exists because leaked passwords are tried everywhere else; a unique password turns a breach into one account's problem.
Turn on a second factor wherever it is offered. It is the reason NIST allows shorter passwords in that case, and it protects you when a password leaks anyway.
Change a password when there is a reason, a breach notice or a suspicious login, not on a calendar.
If you encrypt files yourself, the password is the only protection there is, with no rate limit to help you; the text encryption tool derives its key from your password, so give it the full 20 characters.

Frequently asked questions

How long should a password be according to NIST?

NIST SP 800-63B, revision 4, requires a password used on its own, as the only factor, to be at least 15 characters. A password used only as part of multi-factor authentication may be shorter, but at least 8 characters. Services should allow at least 64 characters so that passphrases fit. Those are minimums for what a service must accept; longer is better, and NIST says users should be encouraged to make passwords as long as they want within reason.

Is a long simple password better than a short complex one?

Yes, by the arithmetic and by NIST's guidance. Each extra character multiplies the number of possibilities by the size of the character set, so 16 lowercase letters (75 bits) beat 8 characters drawn from the full keyboard (53 bits). NIST's appendix on password strength says length is a primary factor, that users respond to composition rules in very predictable ways, and that the benefit of such rules is less significant than initially thought.

Do I still have to change my password every 90 days?

Not according to NIST. Revision 4 says verifiers shall not require subscribers to change passwords periodically, and shall force a change only when there is evidence the password has been compromised. If a site still demands rotation, that is the site's policy, not current guidance.

Are passphrases secure?

A passphrase of several random words is a long password that is easy to type and remember, which is why NIST describes passphrases as often an effective way to create a longer password and asks services to accept at least 64 characters and spaces. Four words chosen at random from a 7,776-word list give about 52 bits; six words give 78. The words have to be chosen at random, by dice or a generator, not by you: a quote or a sentence you would think of is on every attacker's list.

What should a website do with my password?

NIST sets the rules for the service too: store passwords salted and hashed with a suitable password hashing scheme, rate-limit failed attempts, check new passwords against a blocklist of commonly used, expected or compromised passwords, allow password managers, autofill and pasting, verify the entire password rather than truncating it, and never store a hint an unauthenticated visitor can see. A site that caps passwords at 12 characters or forbids pasting is failing those rules.

Sources

Written by Tobias Kurth, designer. Updated October 20, 2026.