Password rules for a small business: what NIST SP 800-63B-4 (2025) actually says
Many small businesses still use password rules from years ago: "at least 8 characters, one capital letter, one number, one symbol, change it every 90 days".
The US National Institute of Standards and Technology (NIST) publishes the best-known guideline on this, SP 800-63B. The current version, SP 800-63B-4, was finalized in July 2025, and it says something quite different.
In this article:
- what the 2025 guideline requires for passwords
- which old rules it tells you to drop
- a short password policy a small business can copy
NIST SP 800-63B is written for US federal systems. It is not a law for private businesses, but it is widely used as a reference for good practice.
The main rules (SP 800-63B-4, section 3.1.1)
| Topic | What the guideline says |
|---|---|
| Minimum length | At least 15 characters if the password is the only factor. At least 8 if it is used together with another factor (multi-factor authentication) |
| Maximum length | Allow at least 64 characters |
| Characters | Accept all printable ASCII characters and spaces; Unicode should be accepted too |
| Complexity rules | Do not require mixtures of character types (capitals, numbers, symbols) |
| Scheduled changes | Do not require people to change passwords periodically. Do force a change if there is evidence the password was compromised |
| Blocklist | Check new passwords against a list of common, expected or compromised passwords, and reject matches |
| Password managers | Allow password managers and autofill. Paste should be allowed |
| Hints and security questions | Do not allow password hints visible to others, and do not use "first pet" style security questions |
| Failed attempts | Limit the number of failed login attempts (rate limiting) |
| Show password | Offer an option to show the password while typing |
In the guideline's own words, verifiers "SHALL NOT impose other composition rules" and "SHALL NOT require subscribers to change passwords periodically".
Why the old rules were dropped
- Forced complexity tends to produce predictable passwords like
Summer2026!, which meet the rules but are easy to guess. - Forced changes every 90 days push people toward small, predictable edits (
Summer2026!→Autumn2026!) or writing passwords down. - Length does more for strength, and a long passphrase is easier to remember than a short, complicated string.
The guideline puts the effort where it helps: long passwords, blocking known-bad passwords, password managers, and multi-factor authentication.
A short password policy you can copy
Adjust this to your systems. Where a service does not let you set a rule (many cloud apps don't), use the closest setting it offers.
- Turn on multi-factor authentication for email, cloud storage, accounting and banking first.
- Length: at least 15 characters, or at least 8 where multi-factor authentication is on. Passphrases (several words) are welcome.
- No forced complexity and no scheduled resets. Change a password right away if it may have been exposed (a breach notice, phishing, a lost device, a staff member leaving who knew it).
- No reuse: every account gets its own password.
- Use a password manager for the business, and allow autofill and paste.
- Block common passwords where the service supports it, and don't use company names, years or "password" variations.
- No shared logins where individual accounts are possible. When someone leaves, remove their access the same day.
- No security questions with real answers. If a service forces them, store a random answer in the password manager.
Quick self-check
- Multi-factor authentication is on for email and cloud storage
- Every account has a unique password
- The business uses a password manager
- Nobody is forced to change passwords on a timer
- There is a written step for "a password may have leaked"
- Access is removed the day someone leaves
Summary
- NIST SP 800-63B-4 (July 2025): 15+ characters for password-only logins, 8+ with multi-factor authentication
- Drop forced complexity and scheduled password changes
- Add blocklists, password managers, multi-factor authentication, and a change when there is evidence of compromise
- It is a US federal guideline, but a useful baseline for any small business
Source: NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (section 3.1.1, Passwords) · Publication record (CSRC)
General information, not legal or compliance advice. This article was drafted with the help of AI and checked against the NIST text on 2026-10-21.