Let password managers work, and drop forced rotation and hints

Password managers are the easiest way for people to use long, unique passwords. NIST says verifiers must allow password managers and autofill and should allow pasting. Blocking paste on the password field mostly hurts people who use a manager.

The same section removes several old habits:

• No periodic changes. Verifiers must not require passwords to be changed on a schedule, but must force a change when there is evidence of compromise.
• No hints that someone who is not signed in can see.
• No security questions when people choose passwords.

Help managers recognise your forms with the right autocomplete values, as in the example. A new password field marked new-password also lets browsers suggest a strong generated password.

To check your own forms: sign up and sign in with a password manager, and paste into each password field. Both should just work.

<form method="post" action="/signup">
  <input type="email" name="email" autocomplete="username" required />
  <input type="password" name="password" autocomplete="new-password"
         minlength="15" maxlength="128" required />
  <button type="submit">Create account</button>
</form>