generatepassword.eu

How long should a password be? NIST SP 800-63B-4 explained

5 min read · Published · Password and DNS Toolbox

Short answer

Use at least 15 characters for any password that is your only login factor, and make it random and unique per site — a password manager does this for you. NIST SP 800-63B-4 (final, August 2025) also tells services to drop forced complexity rules and periodic resets, check new passwords against breach lists, and allow password managers and pasting.

Key points

  • Single-factor passwords: minimum 15 characters. With multi-factor authentication: minimum 8.
  • Length and randomness beat symbols-and-numbers rules.
  • Change passwords when there is evidence of compromise, not on a schedule.

What NIST SP 800-63B-4 requires of services

NIST's Digital Identity Guidelines are the reference many organisations follow. Revision 4 was published in final form on 26 August 2025. For passwords it says services:

  • shall require at least 15 characters when the password is the only authentication factor, and at least 8 when it is part of multi-factor authentication;
  • should accept at least 64 characters and allow Unicode;
  • shall not impose composition rules such as "one uppercase, one digit, one symbol";
  • shall not require periodic password changes, but must force a change when there is evidence of compromise;
  • shall compare new passwords against a blocklist of common, expected or breached passwords;
  • shall allow password managers and autofill, and should allow pasting.

Why length matters more than symbols

For a randomly generated password, strength is measured in bits of entropy: length × log₂(size of the character set). Adding one character multiplies the guesses needed by the size of the set; forcing one symbol barely helps, and people respond to such rules with predictable patterns like Password1!. A random 16-character password from letters, digits and symbols has about 103 bits of entropy — far beyond what any attacker can guess.

What this means for you

  1. Use a password manager and let it generate a unique random password for every account — or use our password generator, which works entirely in your browser.
  2. Choose 16–20 random characters, or a long passphrase for passwords you must type.
  3. Turn on multi-factor authentication wherever it is offered.
  4. Change a password when a service reports a breach or you suspect compromise.

Frequently asked questions

Is a 12-character password enough?

Not for a password that is your only factor under NIST SP 800-63B-4, which sets a minimum of 15. With multi-factor authentication, 12 random characters is strong.

Are passphrases better than random passwords?

Randomly chosen words are strong and easier to type; a four-word passphrase from a large word list is weaker than 16 random characters, so use five or more words.

Should I still use symbols?

They help a little when a site allows them, but length and randomness matter more.

Sources