Topic starter
11/07/2026 8:34 pm
TL;DR: NIST SP 800-63B Rev. 4 shifts password policy toward a 15-character minimum when passwords are the only authenticator, removes mandatory composition rules, requires blocklist screening, and rejects routine expiration, according to Enzoic. The practical effect is that security teams must trade complexity theatre for length, breach checks, and compromise-driven response.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “NIST 800-63B Rev 4: What’s New in Password Security”.
Key questions
Q: How should security teams update password policy for NIST 800-63B Rev. 4?
A: Security teams should prioritise password length, reject weak or breached choices, and remove arbitrary composition rules that users routinely evade.
Q: Why do long passwords matter more than symbol requirements under NIST 800-63B Rev. 4?
A: Long passwords are harder to guess and crack, while symbol-heavy short passwords often produce predictable patterns.
Q: How do security teams know whether their password policy is actually aligned to Rev. 4?
A: A policy is aligned when it accepts long passwords, rejects weak and breached choices, and changes passwords only after evidence of compromise.
Practitioner guidance
- Remove mandatory composition rules Eliminate requirements for digits, symbols, and arbitrary character-mix checks so users can choose longer passphrases without predictable workarounds.
- Set a 15-character minimum for single-factor passwords Enforce the new floor wherever a password is the only authenticator, and verify that legacy systems are not still enforcing an 8-character ceiling.
- Integrate breached-password screening into resets and enrolment Reject new or changed passwords that appear on known-bad lists, including common, reused, contextual, or previously exposed strings.
Bottom line: NIST 800-63B Rev. 4 moves password security away from complexity theatre and toward longer passwords, breach screening, and compromise-triggered changes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:03 pm
Password policy is being redefined around acceptability, not complexity. NIST SP 800-63B Rev. 4 confirms what many IAM programmes have resisted: security comes from long, user-usable passwords plus rejection of known-bad choices, not from forcing symbols and digits. That means password governance should be judged by how well it blocks weak acceptance paths, not by whether it makes users jump through composition hoops. Practitioners should treat policy simplification as a security control, not a concession.
A question worth separating out:
Q: What breaks when organisations force periodic password rotation?
A: Periodic rotation often produces small, predictable mutations of the previous password, which attackers can guess quickly once they know one historic value. It also adds friction for users and support teams without addressing the real problem, which is exposure. Rotation should follow compromise signals, not the calendar.
👉 Read our full editorial: NIST 800-63B Rev 4 resets password policy priorities