How long should a password be? What NIST says

NIST SP 800-63B-4 (2025): at least 15 characters when a password is the only factor, 8 with multi-factor login. No forced complexity rules or routine changes.

Open the Password Generator

The current guidance

The US National Institute of Standards and Technology (NIST) published SP 800-63B-4 in 2025. For systems that follow it:

  • A password used on its own should be at least 15 characters.
  • A password used only as part of multi-factor authentication should be at least 8 characters.
  • Systems should allow passwords of at least 64 characters.
  • Systems should not force mixtures of character types, and should not require routine password changes unless there is evidence of compromise.
  • New passwords should be checked against lists of known breached or common passwords.

In practice

Length matters most. Use a unique password for every account, store them in a password manager, and turn on multi-factor login where you can. Our password generator runs in your browser and does not send passwords anywhere.

Frequently asked questions

Are passphrases OK?

Yes. A long passphrase of several random words meets the length guidance and is easier to type.

Should I change my password every 90 days?

NIST says systems should not force routine changes; change it if it may have been exposed.

Sources

Last reviewed 2026-10-29. General information only, not medical, financial or legal advice.