Why a strong password no longer means uppercase, number, symbol

If a sign-up form still tells you your password needs a capital letter, a digit and a symbol, it is enforcing a rule that the standard it is probably citing now prohibits. NIST published SP 800-63B-4 on 31 July 2025, superseding the 2020 edition, and the wording is not a polite suggestion: verifiers SHALL NOT impose composition rules. Here is what actually changed, and what it means for the passwords you choose yourself.

The rule most sign-up forms still show you

You know the shape of it without being told. Eight characters minimum. At least one capital. At least one number. At least one of the symbols above the number keys. Change it every ninety days. Set a security question in case you forget.

Almost every element of that list is now either explicitly prohibited or explicitly downgraded in current NIST guidance. It has not been softly deprecated in a footnote. In SP 800-63B-4 the composition rule and the rotation rule are both written as SHALL NOT, which in a NIST document is the strongest form of prohibition available.

What SP 800-63B-4 replaced the complexity rule with

The revision does not simply delete the old requirement and leave a gap. It moves the work somewhere more useful. Section 3.1.1.2 requires that a proposed password be checked against ‘a blocklist that contains known commonly used, expected, or compromised passwords’, drawing on breach corpuses, dictionary words and context-specific terms.

• Screening beats shaping. Checking a password against known-breached passwords catches the actual problem — reuse of something already public — which a capital letter never did.
• Password hints are out. Verifiers ‘SHALL NOT permit the subscriber to store a hint’.
• Security questions are out. Verifiers ‘SHALL NOT prompt subscribers to use knowledge-based authentication (KBA)’. Mother’s maiden name is no longer an acceptable backup.
• Long inputs must be accepted. Verifiers should permit at least 64 characters, shall accept every printing ASCII character plus the space, and should accept Unicode.

Length is the part that carries the weight

The floor depends on what else is protecting the account. NIST sets a minimum of 15 characters when the password is the only authentication factor, and 8 characters only when it is used alongside a second factor. That second number is the one that leaked into a decade of consumer articles without its condition attached.

CISA’s consumer guidance goes further, defining a strong password as at least 16 characters, random, and unique to each account, and recommending a password manager to hold them.

The requirement to accept spaces and long inputs matters more than it sounds. It is what makes a passphrase — several words, spaces and all — a legitimate answer rather than a workaround.

What to change about your own accounts

1. Stop rotating passwords on a calendar. Change one when there is evidence it has been exposed, not because ninety days have passed.
2. Fix reuse before you fix anything else. A unique password per account is the control that stops one breach becoming five.
3. Give your handful of critical accounts — email, banking, the password manager itself — genuine length: 16 characters or more, or a passphrase of several unrelated words.
4. Turn on a second factor wherever it is offered, so the 8-character floor becomes the relevant one for the long tail of accounts you barely use.
5. Where a site forces you to add a capital and a symbol anyway, add them and move on. You cannot fix their form; you can make the underlying password long.

Why the complexity habit outlived its evidence

NIST’s own FAQ explains the reasoning behind dropping forced rotation: when people are made to change passwords on a schedule, they choose weaker ones and apply predictable transformations to them. Summer2024! becomes Autumn2024!. The rule produced the behaviour it was meant to prevent.

Character substitution has the same problem. NCSC UK puts it plainly: criminals know these tricks as well, so ‘your password won’t be significantly stronger, but it will be harder for you to remember.’

The rules persist because they are easy to enforce in code and easy to display on a form. A progress bar that turns green when you add an exclamation mark feels like security. Length and uniqueness are harder to make visible, and they are the two things that actually matter.

Sources: NIST SP 800-63B-4, Digital Identity Guidelines · NIST SP 800-63B-4 publication record · NIST SP 800-63 FAQ · CISA — four easy steps to stay safe online · NCSC UK — three random words

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from NIST, CISA and NCSC UK. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.