What NIST recommends now, and what it dropped

Most password advice still in circulation is fifteen years out of date. The current reference is NIST Special Publication 800-63B, and it reversed several rules people still repeat.

Length beats complexity

NIST asks for a minimum of eight characters and requires systems to accept at least sixty-four. It does not require a mix of cases, digits and symbols, because forced composition rules push people toward predictable patterns. Ask for a capital and a number and you get Password1 every time.

Forced rotation is out

The guideline recommends against periodic changes with no evidence of compromise. Rotation makes people iterate, and Summer2024 becoming Summer2025 is worse than one strong password left alone.

Blocklists are in

Instead of composition rules, new passwords should be screened against known-breached lists. A sixteen-character password that appears in a breach corpus is worthless however complex it looks.

A randomly generated password sidesteps all three. No pattern to predict, no reason to rotate, and effectively no chance of appearing in a breach list.

Entropy, in numbers you can act on

Entropy is how many guesses an attacker needs, and each bit doubles that number. The crack column assumes an offline attack at a trillion guesses per second against a fast, poorly protected hash, and reports average time. State the assumption, because a different one gives a wildly different answer.

Two things fall out of this. The jump from eight to twelve characters is worth more than any amount of symbol-stuffing at eight. And past about sixteen characters from a full set, extra length stops buying you anything real. Sixteen to twenty is the sensible range.

Where generated passwords still go wrong

The password is rarely the weak part. Run through this before you call an account secure.

• Reuse. A perfect password used twice is only as strong as the weaker site database.
• Storing it in a note. If it lives in plain text on a synced device, its entropy is decoration.
• Typing it instead of pasting. A twenty-character string typed by hand gets shortened by the person typing it.
• No second factor. A strong password still falls to a convincing phishing page.
• Security questions. Your mother maiden name is often public. Generate random answers and store them too.

Sites that quietly reject or truncate

Plenty of serious services still refuse symbols, cap length at sixteen, or silently truncate what you paste. Truncation is the dangerous one: you paste thirty-two characters, the site stores sixteen, and the login fails in a way that looks like your manager is broken. When that happens, generate again with symbols off and more length. A twenty-character alphanumeric password carries about 119 bits, which is far more than enough.

Frequently Asked Questions

Related Security & Reference Utilities

• Random Team Name Generator: Split participants into balanced groups and assign unique squad titles automatically.

A new account needs a handle and a credential at the same moment. Generating both before you start the signup form means you are not inventing either one under pressure.