Password Policy Recommendations: Strength, Length, and Rotation

Password Policy Has Evolved. Are Your Policies Current?

Password best practices have shifted significantly in recent years. NIST's updated Digital Identity Guidelines (SP 800-63B) and Microsoft's own security recommendations have moved away from several long-held conventions that are now understood to make passwords less secure rather than more.

What NIST Now Recommends

• Minimum length of at least 8 characters: but 12–16 is significantly better; passphrases of 20+ characters are excellent
• Do NOT require regular rotation: Mandatory periodic changes (90-day cycles) cause users to make small, predictable changes and actually reduce security
• DO require changes on evidence of compromise: If a credential appears in a breach dataset or is suspected compromised, require an immediate change
• Screen against known compromised passwords: Check new passwords against breach datasets and your custom banned list
• Allow all printable characters: Don't artificially restrict special characters
• No complexity requirements that reduce entropy: Requiring "at least one uppercase, lowercase, number, and symbol" often results in predictable patterns like "Password1!" that crack immediately

What Pentest Experience Confirms

In internal penetration tests, the most commonly cracked passwords share a pattern: they meet complexity requirements but are variations on predictable patterns. "Company2024!", "Summer23", "[City]P@ss". These crack immediately in targeted attacks. Length is far more valuable than mandatory complexity.

Multi-Factor Authentication Is Not Optional

No password policy fully compensates for the absence of MFA. Even strong, unique passwords can be captured via phishing or keyloggers. MFA, particularly TOTP authenticator apps or hardware tokens, provides a critical secondary layer that password policy alone cannot.

Rolling Out a New Password Policy

Modernizing a password policy works best in stages. Communicate the why before the change, since longer passphrases and breach screening feel different to users than the old complexity rules. Screen new and reset passwords against a banned and breached list, lengthen minimums, and remove routine forced rotation that only produces predictable patterns. Pair the change with multi-factor authentication, and validate the result with testing, since penetration tests routinely crack the predictable passwords a modern policy would have blocked.

Frequently Asked Questions

What is the current best practice for password policy?

Modern guidance from NIST favors longer passphrases, screening against known-breached and weak passwords, and removing forced periodic rotation that is not tied to a compromise. Length and blacklisting beat complexity rules that push users toward predictable patterns.

Should passwords be rotated on a schedule?

Current NIST guidance recommends against routine forced rotation, which drives predictable patterns like adding a number each cycle. Rotate credentials when there is evidence of compromise, and rely on length, breach screening, and multi-factor authentication instead.

Does a strong password policy remove the need for MFA?

No. Even strong passwords get phished or reused. Multi-factor authentication is the control that stops an attacker holding a valid password, which is why penetration tests treat missing MFA as a serious finding.