Orchestrator-workers on NIST SP 800-63B password rules, current revision

NIST SP 800-63B-4: password requirements for verifiers and CSPs

The current revision is SP 800-63B-4, dated 26 Aug 2025. The superseded Rev. 3 page says: "This revision of NIST SP 800-63 has been superseded by NIST SP 800-63-4 as of August 1, 2025." (https://pages.nist.gov/800-63-3/sp800-63b.html). The Rev. 4 page states: "This publication supersedes NIST Special Publication (SP) 800-63B." (https://pages.nist.gov/800-63-4/sp800-63b.html). All quotes below come from the password sections (3.1.1.1–3.1.1.2) of https://pages.nist.gov/800-63-4/sp800-63b.html.

Notes on specific rules:

• Maximum length: 64 is a minimum for the maximum length that verifiers allow. It is not a cap on password length.
• Shorter passwords in multi-factor use: Passwords used only as part of multi-factor authentication may be shorter, but not below 8 characters.
• Forced changes: Even though periodic changes are forbidden, verifiers SHALL force a change when there is evidence of compromise.
• Paste: Allowing "paste" is only a SHOULD. Allowing password managers and autofill is a SHALL.
• Hashing: Salting and hashing with "a suitable password hashing scheme" is a SHALL. Using an approved scheme from SP 800-132 specifically is only a SHOULD.

What wasn't checked:

• No drafts of Rev. 4 were examined.
• I'm not making any claim about how Rev. 3 worded these rules. One worker's recollection of the Rev. 3 wording came from memory, not from a page it opened.
• No worker found any sources that disagreed with each other.

{"answers":[
{"topic":"single-factor-minimum-length","keyword":"SHALL","value":"15","quote":"Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"maximum-length","keyword":"SHOULD","value":"64","quote":"Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"composition-rules","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"periodic-change","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"password-hints","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"security-questions","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"blocklist","keyword":"SHALL","value":null,"quote":"When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"password-managers","keyword":"SHALL","value":null,"quote":"Verifiers SHALL allow the use of password managers and autofill functionality.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"salt-length","keyword":"SHALL","value":"32","quote":"The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes (i.e., to prevent multiple subscriber accounts from having the same hashed password).","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"hashing-scheme","keyword":"SHOULD","value":null,"quote":"An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"}
]}