Plan-execute-verify on NIST SP 800-63B password rules, current revision

All ten requirements come from section 3.1.1.2 (Password Verifiers) of NIST SP 800-63B-4, which is the current revision.

Which revision is current. The CSRC publication page (https://csrc.nist.gov/pubs/sp/800/63/b/4/final) returned a 404 error, so I confirmed the revision another way. The Rev 3 page (https://pages.nist.gov/800-63-3/sp800-63b.html) says: "This revision of NIST SP 800-63 has been superseded by NIST SP 800-63-4 as of August 1, 2025." The Rev 4 HTML page (https://pages.nist.gov/800-63-4/sp800-63b.html) is dated Tue, 26 Aug 2025. Its abstract says it "supersedes NIST Special Publication (SP) 800-63B." I found no newer revision, errata box or withdrawal notice. All quotes below come from that one Rev 4 page.

Requirements (https://pages.nist.gov/800-63-4/sp800-63b.html):

• Minimum length when a password is the only factor: 15 characters (SHALL). This is up from Rev 3's 8-character minimum. Passwords used only within multi-factor authentication MAY be shorter, but SHALL still be at least 8 characters.
• Maximum length: verifiers SHOULD permit a maximum length of at least 64 characters.
• Composition rules (such as requiring a mix of character types): SHALL NOT be imposed. Section 3.1.1.1 says the same.
• Periodic change: verifiers SHALL NOT require it. They SHALL force a change if there is evidence the password has been compromised.
• Password hints that unauthenticated claimants can see: SHALL NOT be permitted.
• Knowledge-based authentication or security questions when a password is chosen: SHALL NOT be prompted.
• Blocklist: verifiers SHALL check new and changed passwords against a list of commonly used, expected or compromised passwords.
• Password managers and autofill: verifiers SHALL allow them. Verifiers SHOULD also allow pasting.
• Salt length: SHALL be at least 32 bits.
• Hashing scheme: an approved scheme from the latest revision of SP 800-132 (or later NIST guidance) SHOULD be used. This is only a SHOULD. The firm requirement is that passwords "SHALL be salted and hashed using a suitable password hashing scheme."

{"answers":[
{"topic":"single-factor-minimum-length","keyword":"SHALL","value":"15","quote":"Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"maximum-length","keyword":"SHOULD","value":"64","quote":"Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"composition-rules","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"periodic-change","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"password-hints","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"security-questions","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"blocklist","keyword":"SHALL","value":null,"quote":"When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"password-managers","keyword":"SHALL","value":null,"quote":"Verifiers SHALL allow the use of password managers and autofill functionality.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"salt-length","keyword":"SHALL","value":"32","quote":"The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes (i.e., to prevent multiple subscriber accounts from having the same hashed password).","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"hashing-scheme","keyword":"SHOULD","value":null,"quote":"An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"}
]}