If you are still crafting passwords like “TuClaveSegura2” and rotating them every few months, it is time to rethink your approach. The U.S. National Institute of Standards and Technology (NIST) published its SP 800-63B-4 guide in July 2025, and it upends much of the conventional wisdom on password security. The document prioritizes length over complexity, prohibits services from imposing mandatory mixes of uppercase letters, numbers, and symbols, and forbids forced periodic changes unless there is evidence of compromise. Meanwhile, Spain’s INCIBE continues to recommend a different set of practices. Here is what each says and how to apply it to your accounts.
- Length is king: NIST mandates a minimum of 15 characters when a password is the sole authentication factor, and at least 8 when used in multi-factor setups.
- No forced complexity or expiry: Services should not require character-type mixes or calendar-based changes; only compromised credentials should be reset.
- Check for leaks: New passwords must be compared against blocklists of common or breached credentials, and tools like Have I Been Pwned’s Pwned Passwords help users do just that.
What Exactly Does NIST Say About Passwords?
The current version of the guide, which according to NIST’s official record supersedes the previous SP 800-63B, lays out clear obligations for services that verify passwords. These rules, while aimed at U.S. government systems, offer a solid blueprint for what constitutes a strong password today.
Key requirements include:
- Minimum of 15 characters if the password is used as the only factor. If it is part of multi-step authentication, a shorter password is allowed, but never below 8 characters.
- Services should permit passwords of at least 64 characters and accept Unicode characters, including spaces.
- No other composition rules can be imposed, such as requiring a mix of different character types.
- No periodic changes can be forced, but a change must be enforced if there is evidence that the password has been compromised.
- Every new password must be compared against a blocklist of common, predictable, or breached passwords, dictionary words, and terms related to the service itself, such as its name or the username.
- Security questions like “What was the name of your first pet?” are out.
- Services must allow password managers and autofill, and should permit pasting the password.
One scope nuance: the guide is intended for U.S. government systems. It does not bind your bank or social network. But its reasoning applies to any user, and services like Have I Been Pwned present themselves precisely as a way to comply with it.
Why Are Symbol Mixing and Periodic Changes No Longer Recommended?
Because people respond to these rules predictably, and attackers know it. The guide’s appendix illustrates this with an example: someone who would have chosen “password” ends up with “Password1” if required to include a capital letter and a number, and “Password1!” if a symbol is also demanded.
The document adds that analyses of stolen password databases show that the benefit of composition rules is smaller than previously thought, while their cost in usability and memorability is high. It also notes a side effect: highly complex passwords are forgotten more often and written down more frequently, sometimes in insecure places.
Expiry follows a similar logic. If every few months you are forced to change a password that has not been stolen, the norm is to add a number at the end or swap a letter. NIST only requires a change when there is evidence that the password has been compromised, which is when it truly matters.
Here is where the clash with Spanish recommendations arises. INCIBE’s page on secure passwords still advises at least 8-10 characters, combining uppercase, lowercase, numbers, and special characters, and changing them at least every 6 months. Its example of a mnemonic rule starts from a phrase, “tu clave segura,” and turns it into “*TuClaveSegura2”.
That recommendation has aged poorly. INCIBE’s example is almost a replica of the pattern NIST cites as typical of what users do under composition rules: recognizable words, initial capital, a number at the end, and a symbol at the beginning. INCIBE does get the important things right, however: do not reuse passwords, avoid personal data, use a manager, and enable two-factor authentication.
How to Create a Good Password (and When You Do Not Need to Invent One)
The practical formula derived from the NIST guide boils down to three ideas:
- Long before weird. Aim for 15 characters or more. NIST notes that passphrases—several words in a row—are often an effective way to achieve length. Better if the words do not form a set phrase or a known quote, because predictability ends up on attackers’ lists.
- Unique for each service. NIST insists on different passwords to prevent credential stuffing, the attack that tries a password stolen from one site on other websites.
- Nothing guessable about you: not the service name, not your username, not dates or names from your circle.
The realistic way to have dozens of long, unique passwords is not to memorize them. A password manager generates and stores each key, and you only remember one long master phrase; NIST notes that managers increase the likelihood of choosing stronger passwords, especially if they include a generator. If you have never used one, start with our guide to password managers: which to choose and how to get started.
And on services that already allow it, the best password is the one that does not exist: passkeys let you sign in without a password. You can find the steps in our guide to enabling passkeys on Google, Microsoft, and iPhone.
An honest reminder from NIST itself: length does not protect you from phishing, keyloggers, or social engineering. A 30-character password handed over on a fake website is worth the same as “123456”.
The most widely used tool is Pwned Passwords, from Have I Been Pwned, which is free. You enter a password and it tells you if it has appeared in known breaches; if so, the site is clear: it should never be used again.
The logical doubt is whether it is safe to type your password into a third-party website. According to its official page, the service receives neither the password nor its full hash: the password is converted into a SHA-1 hash on your own device, and only the first 5 characters of that hash are sent, a method called k-anonymity. The same page states that, as of November 2026, it handles more than 18 billion queries per month and presents the service as a way to comply with NIST’s requirement to compare passwords against breach data.
A password not appearing does not mean it is good; the site itself warns of this. And if you want to know whether your email or accounts have been in a breach, and what to do in that case, you can find it in our guide to checking if your data is in a leak and what to do.
My stance: today’s secure password is not the hardest to type, but the longest one you do not have to remember, different on every site, and absent from any breach. Everything else—mandatory symbols and calendar-based expiry—is the ritual of an era that thought the user was the problem. NIST has corrected course; it is high time Spanish-language guides did the same.