What does NIST SP 800-63B recommend for password policy, and how does it differ from the traditional complexity-and-rotation rules?

NIST SP 800-63B prefers length over complexity, and it drops forced password changes. It moved away from the old rules.

On length and characters:

• Require a minimum length of at least 8 characters. (Revision 4, final in August 2025, requires at least 15 characters when the password is the only factor. The 8-character minimum stays for passwords used inside multi-factor authentication.)
• Support passphrases of at least 64 characters.
• Accept all printable characters, including spaces.
• Don't force composition rules like "one uppercase letter and one symbol". Users answer these rules with predictable patterns, like Password1!.

On changes and checks:

• Don't force regular password changes. Require a change only when there is evidence the password was compromised.
• Instead, check new passwords against lists of breached and commonly used passwords.
• Allow paste, so password managers work.
• Drop password hints and knowledge-based security questions (like "your first pet's name").
• Rate limit failed login attempts.

Why? The old rules cost users a lot of effort and gave little real security. Length, breach checks and MFA actually stop attacks.