Security fundamentals

What makes a good password policy?

Modern guidance (from NIST SP 800-63B) favors longer passwords and passphrases over forced complexity, screening passwords against known-breached lists, dropping arbitrary periodic rotation, and layering multi-factor authentication on top. Length and MFA beat complexity rules.

Definition

A password policy is the set of rules governing how people create and manage passwords. A good modern one prioritizes length, breach-screening, and multi-factor authentication over the old complexity-and-rotation approach.

Background

Current guidance, notably NIST SP 800-63B, changed the old playbook. It favors longer minimums and passphrases, and letting people use long, memorable phrases. It recommends screening new passwords against lists of known-breached credentials, and it advises against arbitrary periodic expiry (which tends to produce weaker, predictable variations) unless there is evidence of compromise. Above all, it treats multi-factor authentication as the control that matters most, because even a strong password can be phished.

Why it matters

Weak and reused passwords are behind a large share of breaches. A policy aligned to modern guidance is both more secure and less annoying, which means people actually follow it, and MFA dramatically reduces the impact of a stolen password.

Step by step

1. Set a sensible minimum length and allow long passphrases (and the full character set).
2. Screen new passwords against known-breached password lists.
3. Stop forcing arbitrary periodic resets; require a change on evidence of compromise.
4. Require multi-factor authentication, especially for privileged and remote access.
5. Encourage or provide a password manager so unique passwords are practical.

Examples

• A company drops 90-day forced resets, raises the minimum length, screens against breached lists, and enforces MFA everywhere.
• Admins are required to use hardware-backed MFA for privileged access.

Common mistakes

• Forcing complex characters and frequent resets, which pushes people toward weaker, predictable passwords.
• Treating a strong password as sufficient without MFA.
• Allowing password reuse across systems with no manager to make uniqueness feasible.

FAQ