# Password Rules NIST Says to Stop Using

> Forced 90-day changes, symbol rules and security questions are all things NIST tells verifiers not to impose. Here is the current guidance, and what changed.

[Home](https://seoagencynaples.com/) / [Blog](https://seoagencynaples.com/blog/) / Technical SEO Site Protection
# The Password Rules Your Business Follows Are the Ones NIST Tells You to Stop Using
Most small businesses run a password policy assembled from advice that the standards body behind it has since withdrawn. The forced quarterly change is not just unnecessary. It is the specific practice the current guidance tells systems not to impose.

By [Jamie Kloncz](https://seoagencynaples.com/jamie-kloncz/), Founder and CEO, SEO Elite Agency ** 15 min read ** Published August 29, 2026

There is a document behind almost every password rule you have ever been given. It is the NIST digital identity guidance, and the current version was published in July 2025, superseding the revision from 2020 [1](#ref-1). Most articles quoting "what NIST says" are quoting the older one, which is why the advice circulating is a version behind.
Three of the most common rules in small business systems are now things the guidance says a verifier shall not do: requiring periodic password changes, imposing composition rules such as a required symbol, and using security questions [1](#ref-1). Not discouraged. Shall not. Meanwhile one number moved in the other direction, and almost nobody has noticed.
This guide covers what the current guidance actually requires, the length change that matters most if you have no second factor, why not all multi-factor authentication is equally useful, and the least glamorous question in website security: who still has an administrator account on your site. One caveat first, and it matters.

## Three rules the guidance now tells systems not to impose
The current NIST guidance states that verifiers shall not require periodic password changes, shall not impose composition rules such as requiring mixed character types, and shall not prompt for security questions. All three of those remain standard practice in a great many small business systems today.
Start with the caveat, because it changes how to read everything below. NIST SP 800-63B is written for federal agencies and the digital identity systems they operate. It is not law for a Naples business, and nobody is going to audit your login screen against it. It is a benchmark, and a good one, because it is the document most security advice is ultimately derived from, usually at second or third hand.
The first prohibition is the one that will surprise people most. The guidance states that verifiers shall not require subscribers to change passwords periodically, and that a change shall be forced only where there is evidence the authenticator has been compromised [1](#ref-1). The quarterly password reset, still standard in a great many businesses, is the specific practice being ruled out.
The second concerns complexity theater. Verifiers shall not impose composition rules, with the guidance giving the example of requiring mixtures of different character types [1](#ref-1). The requirement for a capital, a number and a symbol produces predictable results, because people satisfy it in predictable ways, and it makes passwords harder to remember without making them meaningfully harder to guess.
The third is security questions. The guidance states that verifiers shall not prompt subscribers to use knowledge-based authentication, giving the example of asking the name of a first pet, or use security questions when choosing passwords [1](#ref-1). The answers are frequently discoverable, sometimes from the business own website, and they function as a weaker parallel password that bypasses the strong one.

## The number that moved, and what it implies
The July 2025 revision requires a minimum of 15 characters where a password is the only factor, and permits eight only where the password is part of a multi-factor process. The widely quoted eight-character minimum comes from the superseded revision.
Here is the change almost nobody has reported. The guidance requires passwords used as a single-factor authentication mechanism to be a minimum of 15 characters, and allows passwords that are only used as part of multi-factor authentication processes to be shorter, with a minimum of eight [1](#ref-1). Read that as a trade: the second factor is what buys you the shorter password.
That reframes the MFA decision usefully. Turning on a second factor is not only a security upgrade, it is what makes a normal-length password acceptable in the first place. If you have no second factor on your website administrator account, the current bar for that password alone is nearly double the figure most people are working from.
Length is also where the guidance is generous rather than restrictive. It says verifiers should permit a maximum password length of at least 64 characters [1](#ref-1), and its own appendix advises allowing at least 64 characters to support passphrases and encouraging people to make passwords as long as they want, using any characters they like including spaces. A short maximum length is a defect, not a security measure.
The practical consequence for a small business is a simpler policy than the one it probably has. Long passphrases, no forced expiry, no composition rules, and a second factor wherever the platform offers one. That is less work to administer than the quarterly reset cycle, which is worth saying because security advice usually asks for more effort rather than less.
Common policy What the current guidance says Practical effect
Change every 90 days Shall not require periodic change Encourages small predictable variations
Must include a symbol and a number Shall not impose composition rules Harder to remember, not harder to guess
Security questions as backup Shall not prompt for knowledge-based authentication A weaker parallel route into the account
8 characters minimum 15 minimum if the password is the only factor Most single-factor logins are under the bar
Short maximum length Should permit at least 64 characters Blocks passphrases, which are the easy win

Source: NIST SP 800-63B-4 and CISA, Implementing Phishing-Resistant MFA Download SVG

## What to check a password against instead
Rather than composition rules, the guidance requires comparing a new password against a blocklist of commonly used, expected or compromised values, with the whole password compared rather than substrings. That is a check against reality instead of a check against a pattern.
If the rules are gone, something has to replace them, and the replacement is better targeted. When a password is set or changed, the guidance requires the verifier to compare it against a blocklist containing known commonly used, expected or compromised passwords [1](#ref-1). The question changes from whether the password looks complicated to whether it is already known to attackers.
One detail in that requirement is worth noting because it prevents a common implementation mistake. The entire password shall be subject to comparison, not substrings or words that might be contained within it [1](#ref-1). A passphrase containing a common word is not thereby a bad passphrase, and systems that reject anything containing a dictionary word are solving a problem the guidance does not describe.
The guidance also notes that excessively large blocklists give little incremental benefit, because the blocklist defends against online attacks that are already limited by rate limiting [1](#ref-1). And where a password is rejected, verifiers shall offer guidance to help the person choose a strong one, which the document notes is particularly important after a rejection because it discourages trivial modifications of a weak password [1](#ref-1).
For a small business none of this requires buying anything. Most password managers and several platforms already check new credentials against known breach corpora. The useful shift is conceptual: stop grading passwords on how they look and start checking whether they have already appeared in a breach, which is the only property an attacker actually exploits.

## Not all second factors are equally useful
CISA states that MFA forms differ in strength and names the attacks each is exposed to: phishing, push bombing, SS7 interception of text messages, and SIM swap. It ranks phishing-resistant methods highest, app-based authenticators next, and codes sent by text or voice lowest of all.
Turning on multi-factor authentication is the single highest-value change most businesses can make, and the version you choose still matters. CISA states plainly that not all forms of MFA are equally secure, and that some are vulnerable to phishing, push bombing attacks, exploitation of SS7 protocol vulnerabilities, and SIM swap attacks [2](#ref-2).
The two attacks worth understanding are the ones aimed at your phone number rather than your phone. SS7 vulnerabilities in communications infrastructure can be exploited to obtain codes sent by text or voice [2](#ref-2). SIM swap is social engineering in which attackers convince a cellular carrier to transfer control of a phone number to a SIM card they control [2](#ref-2), after which every code sent by text arrives with them.
CISA ranks the options from strongest to weakest. Phishing-resistant methods, meaning FIDO and WebAuthn authentication and public key infrastructure based approaches, sit at the top and are described as "the gold standard" [2](#ref-2). App-based authenticators come next, covering one-time codes, token-based codes and push notifications with number matching. Text message and voice codes are the weakest tier listed.
The honest framing for a small business is not to dismiss the weaker options. A text-message code is enormously better than no second factor, and CISA has consistently urged organizations to implement MFA for all users and all services [2](#ref-2). Where phishing-resistant methods are not yet practical, CISA points to additional controls such as number matching [2](#ref-2). Start where you can, then improve the method.

- A second factor of any kind beats no second factor.
- Codes by text are the weakest tier CISA lists, for reasons it names.
- An authenticator app is a free upgrade over text messages.
- Passkeys and security keys are what CISA calls phishing-resistant.
- Turn it on for email first. Email is how every other account is reset.

## The question nobody asks: who still has an account?
Credential strength is irrelevant if a developer from four years ago still holds an administrator login. The inventory is free, takes an afternoon, and is the part of this subject that never appears in security marketing because nothing needs to be purchased.
Everything above concerns the strength of a credential. This section concerns how many of them exist, which is usually the larger problem and always the cheaper one to fix. Open the users list on your website and read it properly. On most small business sites it contains people who left, contractors who finished, plugins that created accounts, and at least one login nobody present can identify.
This connects directly to the compromise route we covered in [what Google does when a site is hacked](https://seoagencynaples.com/blog/website-hacked-google-search-naples/), because an unused administrator account is a working door that nobody is watching. It also mirrors the ownership problem in [who actually controls your domain name](https://seoagencynaples.com/blog/who-owns-your-domain-name/). In both cases the risk is not sophistication, it is that access outlived the relationship it was created for.
The remedy is a list and a habit. Write down every system that grants access to your business online: the website, the domain registrar, the hosting account, email, Google Business Profile, analytics, social accounts and any booking or invoicing tool. For each one, name who has access and why. Anyone you cannot justify gets removed, and anyone who leaves gets removed the week they leave rather than at some future tidy-up. The principle is in the guidance too: compromised authenticators are to be suspended, invalidated or destroyed promptly once compromise is detected [1](#ref-1).
And the boundary on what we will claim, which is the same one we set in [the piece on patching](https://seoagencynaples.com/blog/website-security-updates-patch-window/). None of this makes an account impossible to compromise, and we are not going to tell you otherwise. What it does is remove the routes that require no skill at all: a shared password from 2021, a former contractor still holding administrator rights, and a login with no second factor on it. If you would like a look at how your setup currently stands, our [free SEO audit](https://seoagencynaples.com/free-seo-audit/) is a reasonable starting point.

- **List every system that grants access.** Website, registrar, hosting, email, Business Profile, analytics, booking, invoicing.
- **Read the users list on each one.** Name every account and why it exists. Unidentifiable accounts are the finding.
- **Remove access the week somebody leaves.** Not at the next review. Access that outlives a relationship is the common failure.
- **Turn on a second factor, starting with email.** Email resets everything else, so it is the account that protects the others.
- **Replace text-message codes where you can.** An authenticator app costs nothing and removes the SIM swap route.
- **Stop forcing password changes.** Change on evidence of compromise, which is what the current guidance actually asks for.

Test yourself
## Which password rules survive checking?
Five questions from the current NIST authentication guidelines and a CISA fact sheet on MFA, both linked in this guide.

- 1 What does NIST say about forcing periodic password changes? Every 90 days Every 12 months That verifiers shall not require it Only for admin accounts **Answer:** That verifiers shall not require it The guidance states that verifiers shall not require subscribers to change passwords periodically, and that a change should be forced only where there is evidence the credential has been compromised. That is a prohibition rather than a preference. The reasoning is behavioral: people asked to change a password every quarter tend to make small predictable modifications, which is easier to guess rather than harder.
- 2 What is the minimum length where a password is the only factor? 8 characters 12 characters 15 characters There is no minimum **Answer:** 15 characters The July 2025 revision requires a minimum of 15 characters where a password is used as a single-factor authentication mechanism, and allows a minimum of eight only where the password forms part of a multi-factor process. The widely quoted eight-character figure comes from the previous revision, which this one supersedes. If you have no second factor, the bar is nearly twice what most people believe.
- 3 What does NIST say about requiring a symbol, a number and a capital letter? It is required Verifiers shall not impose such composition rules Only for financial systems It is optional but recommended **Answer:** Verifiers shall not impose such composition rules The guidance states that verifiers and credential service providers shall not impose composition rules, giving the example of requiring mixtures of different character types. It also says they shall not use knowledge-based authentication or security questions when choosing passwords. Both practices are extremely common in small business systems and both are now explicitly ruled out in the guidance most of those systems claim to follow.
- 4 Are all forms of MFA equally secure? Yes No, CISA ranks them and names specific attacks Only text-message codes are weak It depends on the vendor **Answer:** No, CISA ranks them and names specific attacks CISA states plainly that not all forms of MFA are equally secure, and lists the specific attacks: phishing, push bombing, exploitation of SS7 protocol vulnerabilities to intercept codes sent by text, and SIM swap. Its table ranks phishing-resistant MFA highest, then app-based authenticators, with text message and voice codes weakest. All of them are better than no second factor at all.
- 5 What is a SIM swap attack? Cloning a phone Convincing a carrier to move your number to another SIM Stealing a phone Intercepting WiFi **Answer:** Convincing a carrier to move your number to another SIM CISA describes SIM swap as a form of social engineering in which threat actors convince cellular carriers to transfer control of a user phone number to a SIM card the attacker controls. Once the number moves, any authentication code sent by text goes to the attacker. This is the reason text-message codes sit at the bottom of the ranking, and the reason moving to an authenticator app is a genuine improvement for very little effort.
Honest self-check. There is no sign-up, and nothing is stored.

Questions answered
## Straight answers to the common questions
The questions readers ask about this topic, answered directly. **No forms, no sales pitch.**

JAMIE KLONCZ · SEO AGENCY NAPLES ************** ONLINE
Pick a question on the left, or search above. You will get the direct answer, the way an answer engine would give it.

← PREV NEXT → [FREE AUDIT →](https://seoagencynaples.com/free-seo-audit/)

- **Should we still make staff change passwords every 90 days?** The current NIST guidance says verifiers shall not require subscribers to change passwords periodically, and that a change should be forced only where there is evidence the credential has been compromised. That is a prohibition in the guidance rather than a suggestion. The reasoning is behavioral rather than mathematical: when people are required to change a password every quarter they tend to make small, predictable modifications to the one they already had, which makes the result easier to guess rather than harder. Dropping the policy is one of the rare security changes that reduces both risk and administrative work at the same time.
- **How long should a password actually be?** It depends on whether you have a second factor, and this is the number that changed. The July 2025 revision of the NIST guidance requires a minimum of 15 characters where a password is used as the only authentication factor, and permits a minimum of eight only where the password forms part of a multi-factor process. The commonly quoted eight-character minimum comes from the previous revision, which this one supersedes. The guidance also says systems should permit at least 64 characters and encourages passphrases, including the use of spaces, so length is where you should be generous.
- **Do we need to require a capital letter, a number and a symbol?** No, and the current guidance says systems should not impose that requirement. It states that verifiers shall not impose composition rules, giving the example of requiring mixtures of different character types. It separately says they shall not prompt for knowledge-based authentication or security questions when choosing passwords. Both practices remain extremely common in small business systems. What replaces them is a check against a blocklist of commonly used, expected or compromised passwords, which tests whether a password is already known to attackers rather than whether it looks complicated.
- **Is text-message two-factor authentication worth using?** Yes, if the alternative is nothing, but it is the weakest form CISA lists and it is worth upgrading when you can. CISA states that not all forms of MFA are equally secure and names the specific weaknesses: exploitation of SS7 protocol vulnerabilities in communications infrastructure to obtain codes sent by text or voice, and SIM swap, in which attackers convince a cellular carrier to move a phone number to a SIM card they control. Both attacks target the phone number rather than the phone itself. Moving to an authenticator app removes that route entirely and costs nothing.
- **What is phishing-resistant MFA?** It is the category CISA ranks highest and describes as the gold standard, covering FIDO and WebAuthn authentication and public key infrastructure based methods. In practice these are passkeys and physical security keys. What makes them phishing-resistant is that the credential is bound to the real website, so a convincing fake login page cannot capture anything reusable, and the attacks that work against other methods, including push bombing, SS7 interception and SIM swap, do not apply. CISA recognizes that not every application supports them yet and suggests interim controls such as number matching where they are not available.
- **Does NIST guidance legally apply to my business?** No. NIST SP 800-63B is written for federal agencies and the digital identity systems they operate, and nobody is going to audit a Naples business against it. It is worth following as a benchmark rather than as a rule, for a specific reason: it is the document from which most mainstream password advice is ultimately derived, usually at second or third hand and often from a superseded revision. Reading the current version directly is how you find out that three rules you are probably enforcing are ones the source document tells systems not to impose.
- **What is the single most useful thing to do this week?** Open the users list on your website and on your email account, and read every entry. Credential strength does not matter if a contractor from four years ago still holds an administrator login, and on most small business sites there is at least one account nobody present can identify. Then turn on a second factor for email first, because email is the reset path for everything else you own. Those two actions cost nothing, take an afternoon, and remove the access routes that require no skill at all, which are the ones most likely to be used.

## References

- NIST. SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (supersedes SP 800-63B, 2020). published July 2025, accessed 29 August 2026. [https://pages.nist.gov/800-63-4/sp800-63b.html](https://pages.nist.gov/800-63-4/sp800-63b.html)
- CISA. Implementing Phishing-Resistant MFA. fact sheet dated October 2022, accessed 29 August 2026. [https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)

Written by
## [Jamie Kloncz](https://seoagencynaples.com/jamie-kloncz/)
Founder and CEO, SEO Elite Agency
Jamie Kloncz is the founder and CEO of SEO Elite Agency, the firm behind SEO Agency Naples. An engineer who scaled his own plumbing business to 3 million dollars in revenue and led growth for over 200 teams, he built this agency on one principle: every SEO action must connect directly to revenue, not vanity metrics.
[More about Jamie →](https://seoagencynaples.com/jamie-kloncz/)

Free · No pressure
## See where your business actually stands
Start with a free audit of your rankings, Google Business Profile, technical health, and AI-search visibility, with a prioritized plan and an honest quote for your situation.
[Get your free audit](https://seoagencynaples.com/free-seo-audit/)

Keep reading
## Related guides
[Technical SEO Who Actually Controls Your Domain Name, and the 60-Day Trap Most Owners Find Too Late Read guide →](https://seoagencynaples.com/blog/who-owns-your-domain-name/)[Technical SEO Your Website Was Not Targeted, It Was Scanned: What Google Does When a Site Is Hacked Read guide →](https://seoagencynaples.com/blog/website-hacked-google-search-naples/)[Technical SEO The Federal Patch Deadline Is Now Three Days. When Was Your Website Last Updated? Read guide →](https://seoagencynaples.com/blog/website-security-updates-patch-window/)