Plan-execute on NIST SP 800-63B password rules, current revision

I've identified the keyword, value and a word-for-word quote for all ten topics. Every quote comes from the Revision 4 text at https://pages.nist.gov/800-63-4/sp800-63b.html.

Which revision is current: The page is titled "NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management" and dated 26 Aug 2025. Its abstract says "This publication supersedes NIST Special Publication (SP) 800-63B." The 2017 Revision 3 is still online at https://pages.nist.gov/800-63-3/sp800-63b.html, but I didn't quote it. One gap: the CSRC landing page (https://csrc.nist.gov/pubs/sp/800/63/b/4/final) returned a 404 error. So I couldn't check NIST's official status page to rule out a later errata update or draft. My search turned up nothing newer than Revision 4.

What Revision 4 says (sections 3.1.1.1 and 3.1.1.2):

• Minimum length: Verifiers and CSPs SHALL require at least 15 characters for a password that is the only authentication factor. A password used only as part of multi-factor authentication MAY be shorter, but it SHALL still be at least eight characters.
• Maximum length: they SHOULD permit a maximum length of at least 64 characters.
• Composition rules, periodic changes, hints and security questions: all are SHALL NOT. For periodic changes, verifiers still SHALL force a change if there is evidence the password has been compromised.
• Blocklist: verifiers SHALL compare a new or changed password against a blocklist.
• Password managers: verifiers SHALL allow password managers and autofill. They SHOULD also permit "paste".
• Storage: passwords SHALL be salted and hashed, and the salt SHALL be at least 32 bits. Using an approved hashing scheme from the latest revision of SP 800-132 is only a SHOULD, not a SHALL.

The text on the page matched the plan's expected keywords for every topic, including SHOULD for the SP 800-132 hashing scheme.

{"answers":[
{"topic":"single-factor-minimum-length","keyword":"SHALL","value":"15","quote":"Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"maximum-length","keyword":"SHOULD","value":"64","quote":"Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"composition-rules","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"periodic-change","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"password-hints","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"security-questions","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"blocklist","keyword":"SHALL","value":null,"quote":"When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"password-managers","keyword":"SHALL","value":null,"quote":"Verifiers SHALL allow the use of password managers and autofill functionality.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"salt-length","keyword":"SHALL","value":"32","quote":"The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},
{"topic":"hashing-scheme","keyword":"SHOULD","value":null,"quote":"An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"}
]}