Topic starter
06/07/2026 9:34 am
TL;DR: NIST’s latest Digital Identity Guidelines move away from mandatory complexity rules and periodic password changes, while reinforcing longer passphrases, password manager support, blocklists for breached credentials, and phishing-resistant options such as passkeys, according to Descope. The practical lesson is that password policy should reduce predictable human workarounds, not preserve outdated assumptions about how users behave.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “NIST Password Guidelines: What You Need to Know”.
By the numbers:
- The average user clocks in at 225 passwords, according to NordPass.
Key questions
Q: What breaks when organisations rely only on password complexity rules?
A: Password complexity rules break down when attackers can still automate guesses, reuse breached credentials, or crack offline hashes.
Q: When should organisations force a password change?
A: Organisations should force a password change when there is evidence of compromise, such as leaked credentials, suspicious authentication activity, or confirmed account exposure.
A: Strong password policy starts with length, uniqueness, and unpredictability, then backs those rules with a password manager and multifactor authentication.
Practitioner guidance
- Remove mandatory composition rules Eliminate forced upper, lower, symbol, and number mix requirements that encourage predictable password patterns.
- Stop calendar-based password rotation Change passwords only when there is evidence of compromise, rather than on fixed intervals.
- Enable password manager and paste support Allow password managers, autofill, paste, and show or hide toggles so users can adopt longer passphrases without being pushed into weaker memorisation habits.
Bottom line: NIST’s updated guidance confirms that many legacy password rules survive more on habit than on security value.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:49 am
Password complexity theatre is a governance failure, not a user failure: NIST’s guidance reflects a simple truth that many programmes still miss. If users respond to complexity rules with predictable patterns, the control creates the appearance of discipline without the security outcome. The implication is that authentication policy must be judged by actual attacker resistance, not by how strict it looks on paper.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between password managers and password complexity rules?
A: Password complexity rules force users to create secrets that meet arbitrary character patterns, while password managers help them use longer, unique, and less predictable credentials without relying on memory. In practice, managers improve usability and reduce reuse, whereas complexity rules often create predictable behaviour that attackers can exploit. The stronger control is the one users can actually sustain.
👉 Read our full editorial: NIST password guidance shows why legacy auth rules still fail