Chapter 1 · Practice 1 of 4
Require length, not complexity rules
Why it matters
Rules like "one uppercase, one digit, one symbol" push people toward Password1!, which every cracking list already contains. NIST SP 800-63B-4 says verifiers must not impose composition rules and should set length requirements instead:
| Rule | NIST SP 800-63B-4 |
|---|---|
| Minimum length, password is the only factor | 15 characters |
| Minimum length, password is one factor of MFA | 8 characters |
| Maximum length you accept | at least 64 characters |
| Characters | printable ASCII, spaces and Unicode |
| Composition rules (mixed types) | must not be required |
Long passphrases such as four random words are both easier to remember and harder to guess than short complex strings, so allow spaces and do not cap length at 16 or 20.
When you count length, count Unicode code points rather than bytes, and apply NFC normalization before hashing so the same password typed on two keyboards produces the same value.
Do
- Set a 15 character minimum where the password is the only factor
- Accept at least 64 characters, including spaces and Unicode
- Show a live length counter rather than a list of character rules
Avoid
- Forcing uppercase, digits and symbols
- A low maximum such as 16 or 20 characters
- Silently truncating long passwords