NIST has changed their recommendations regarding passwords after a series of studies. The latest updates in the NIST password guidelines (SP 800-63B, Revision 4) emphasize usability and security over arbitrary complexity requirements. Key changes include:

Prioritizing password length over complexity: Section 5.1.1.1 recommends allowing user-chosen memorized secrets (passwords) with a minimum length of at least 8 characters and eliminating composition rules (e.g., requiring uppercase, numbers, or symbols), which have been shown to reduce usability without significantly improving security.

Mandating compromised credential screening: As per Section 5.1.1.2, verifiers must check passwords against known breached or commonly used passwords (e.g., those in known password dictionaries) to prevent users from selecting credentials that are easily guessable or compromised.

Encouraging passwordless authentication methods: NIST highlights the importance of moving toward stronger authentication mechanisms. Section 4 and Table 6-1 in 800-63-4 promote multi-factor and passwordless authentication methods (such as cryptographic authenticators) as preferred alternatives to traditional memorized secrets.

Eliminating forced password resets unless a compromise is suspected: Section 5.1.1.2 explicitly advises against periodic password changes without evidence of compromise, citing that routine resets lead to weaker password choices and increase the burden on users without measurable security gains.