Password Advice That Changed
Last updated: October 2026
Old password advice said: change every 90 days, use symbols, mix character types. Modern guidance from NIST says otherwise.
What changed
- No forced periodic change: change on evidence of compromise, not on a schedule
- No composition rules: symbols and mixed character types are not required
- Length matters most: 15-character minimum, 64+ allowed
- Password managers and paste must be allowed
What stayed the same
- Use unique passwords for every account
- Longer passwords are exponentially harder to crack
- Randomness matters: avoid patterns and personal information
Sources
- [NIST SP 800-63B-4 URL] — NEEDS URL (user to supply)
- [NCSC password guidance URL] — NEEDS URL (user to supply)
- NIST SP 800-63B-4 (final Aug 2025) - digital identity guidelines