Quick answer: The password policy considered "standard" for years (forced change every 90 days, mandatory upper/lower/digit/symbol complexity) is today considered wrong by NIST and other authorities, because it pushes users toward predictable patterns like Password1!, Password2! and toward writing passwords down. The modern approach (NIST SP 800-63B): reward length (allow long passphrases, 64+ characters), remove mandatory complexity rules, require a change ONLY on suspicion of compromise (no forced periodic rotation), check every new password against a known breached password list, allow password managers and pasting, and move the real security to MFA and passkeys. In short: less friction plus breach checking plus MFA is more secure than complex rules.

Password policy is the area in security that carries the most wrong inheritance. Many organizations still apply rules from the 2000s and think they provide security; yet these rules both tire the user and in practice lead to weaker passwords. This guide explains NIST SP 800-63B's modern password approach, why the old rules were abandoned, and how to update an enterprise policy.

Why the old rules are wrong

Two old rules are the most harmful: forced periodic rotation and mandatory composition (complexity) rules.

Forced periodic rotation (for example every 90 days): research showed that users do not choose the new password strong from scratch but derive it from the old one with a small change (Win2024! to Win2025!). So rotation produces predictable patterns and does not increase security, it even decreases it; moreover it pushes users to write passwords down. NIST therefore removed forced periodic change: a password should be changed only on suspicion of breach/compromise.

Mandatory composition (at least one uppercase, one digit, one symbol): pushes the user toward predictable, minimally compliant passwords like Password1!. Entropy (real randomness) comes from length, not from a forced symbol. NIST no longer recommends composition rules; instead it encourages length.

NIST SP 800-63B modern principles

Principle Old (wrong) Modern (NIST 800-63B)
Length 8, complexity mandatory min 8, allow long passphrases 64+
Complexity mandatory upper/digit/symbol no rule imposed, encourage length
Rotation mandatory every 60-90 days none, only on breach
Breach check none check against known breached list
Password manager blocked, pasting disabled encourage, allow pasting
Hint/security question common remove (predictable)

Additional modern principles: allow Unicode and spaces (for passphrases), offer a "show" option on screen, and at registration and change check the new password against a breached password blocklist (reject common, dictionary and known breach passwords). This way passwords like 123456, password or the company name are blocked from the start.

Passphrase: long but memorable

The heart of the modern approach is the passphrase: a long but memorable string of several independent words (for example four random words). Length increases entropy, and it is both stronger and more user friendly than memorizing complex symbols. The organization should encourage users toward passphrases and allow 64+ characters; for those who use a password manager, a randomly generated long password is best. We covered choosing and using a password manager in our how to choose a password manager article.

A password alone is not enough: MFA and passkeys

The most important admission of the modern policy is this: even the best password is not enough alone, because phishing, breach and reuse can capture the password. Therefore the real security is in multi factor authentication (MFA) and increasingly in passkeys.

A passkey (FIDO2/WebAuthn) removes the password entirely and moves to a device bound cryptographic identity; it is phishing resistant because there is no "secret" to give to a fake site. Not all MFA is equal either: an SMS code is weak to SIM swap and interception; an authenticator app is better; a passkey/hardware key is the strongest. We examined the comparison of MFA types in our two factor authentication and passkey article. Even if the password is captured, MFA/passkey closes the second door; we covered account takeover scenarios in our account takeover and recovery article.

Hardening the enterprise policy

Limiting the attack on a password is as much a policy matter as protecting the password. Put rate limiting and an account lockout threshold on login endpoints so brute force and credential stuffing do not work; we covered applying this at the edge in our Cloudflare security configuration article. Always store passwords with a strong, slow hashing algorithm (bcrypt, scrypt, Argon2) and a salt; never plain text or weak hashing (single MD5/SHA1). Prioritize business email and administrator accounts; these are the target of BEC and CEO fraud, which we described in our BEC fraudulent transfer article.

The KAOS and DSET approach

At DSET, in an enterprise password policy assessment we flag legacy rules (forced rotation, mandatory complexity, paste blocking) and modernize them per NIST 800-63B: length based, breach checked, MFA/passkey first. The KAOS tool we develop looks for identity weaknesses such as weak password storage (plain text, MD5), missing account lockout/rate limiting and absence of MFA during a scan, and does not exaggerate a finding without verifying it. To modernize your organization's identity and password security, contact DSET with our team at Ankara Hacettepe Teknokent.

Frequently asked questions

If I stop forcing a password change every 90 days, won't security drop? No, modern evidence shows the opposite. Forced periodic rotation pushes users toward predictable patterns (Win2024! to Win2025!) and toward writing passwords down, so it does not increase security and even decreases it. The right approach is to require a change only on suspicion of breach/compromise and instead invest in length, breach checking and MFA.

If I remove the mandatory complexity (symbol, digit) rule, won't it be weak? No. Mandatory complexity pushes users toward minimally compliant, predictable passwords like Password1!. Real strength comes from length (entropy). A long passphrase is both stronger and more user friendly than a short password with forced symbols. Instead of a composition rule, encourage length and run the new password through a breached list check.

Isn't allowing password managers and pasting risky? On the contrary, NIST recommends allowing pasting and encouraging password managers. Blocking pasting pushes users toward simple, memorable (therefore weak) passwords. A password manager ends reuse by generating and storing unique, long random passwords for each account, which removes the biggest practical password risk.

Sources