In 2017, the man who wrote the password rules the whole world followed told the Wall Street Journal he was sorry.
Bill Burr authored the NIST guidance, back in 2003, that gave us the modern password ritual: at least one uppercase letter, one number, one symbol, and change it every 90 days. Two decades of “Password1!” became “Password2!” because of that document. And Burr’s verdict, looking back: “Much of what I did I now regret.”
He was right to regret it, and the interesting part is that NIST agreed. They tore those rules out in 2017. Then in July 2025 they finalized the replacement — SP 800-63B-4 — and made the break even cleaner. Which raises the obvious question: if the standard has said the opposite of the old rules for eight years now, why does every corporate login screen still demand a symbol and threaten to expire your password in 90 days?
What the 2003 rules actually did
The complexity-and-rotation regime didn’t just fail to help. It actively made passwords worse, and it did so in a predictable way that anyone who has worked a help desk can recite from memory.
Force a symbol and a number, and people don’t generate entropy — they append 1! to a word. Force a change every 90 days, and Summer2024! becomes Summer2025! becomes Autumn2025!. The rotation didn’t produce new secrets; it produced a sequence. Worse, a password you’re forced to change four times a year is a password you write on a sticky note, because you can’t memorize a moving target.
The rules optimized for theoretical entropy on a whiteboard and got predictability in the wild. They also trained a generation of users to experience security as an arbitrary tax — a lesson that made every real security ask harder to land.
What 800-63B-4 actually says
Read the 2025 document and it’s almost the exact inverse of 2003. The requirements for password verifiers, in plain terms:
- No composition rules. Verifiers “SHALL NOT impose other composition rules” — no mandatory mix of character types. Length does the work.
- No periodic expiration. Passwords shall not be forced to rotate on a schedule. You change a password when there’s evidence it was compromised, not because a calendar flipped.
- Check against breach corpora. When a password is set or changed, the verifier shall compare it against a blocklist of “commonly used, expected, or compromised” values — and compare the entire password, not fragments. This is the requirement that actually moves the needle.
- No security questions. Knowledge-based authentication — mother’s maiden name, first pet — is out. It was never a secret; it’s public records and social media.
- No password hints that an unauthenticated visitor can retrieve.
- Allow long passwords and paste. Support at least 64 characters, don’t truncate, and let password managers paste. Blocking paste to “improve security” was always backwards.
The philosophy shifted from make the user construct entropy to screen out passwords already known to attackers. A 40-character passphrase that has never appeared in a breach dump is worth more than Xq7! complexity theater, and the standard now says so out loud.
The 15-character thing nobody is ready for
Here’s the part the summaries gloss over. The final version tightened the length floor in a way the earlier drafts didn’t.
800-63B-4 says verifiers “SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters.” Fifteen. If the password is your only line of defense, eight characters no longer clears the bar. Passwords used purely as one factor inside MFA may be shorter, but even those shall be at least eight.
Fifteen characters is not a tweak to a policy field. It breaks the muscle memory of every user who has typed an eight-character password for twenty years, and it quietly pushes the whole industry toward passphrases, because nobody is going to hold a random 15-character string in their head. I’d bet most organizations “comply” the lazy way — bolt on MFA so their eight-character passwords become one-of-two-factors and stay legal. Which, if you squint, is exactly the outcome NIST wanted: stop leaning on the password alone.
Why the behavior didn’t change
The standard has said “no forced rotation” since 2017. Your bank, your employer, and your kid’s school portal mostly didn’t get the memo. The gap between the guidance and the login screen is the whole story here, and it isn’t stupidity — it’s inertia with structure.
A policy lives in a dozen places downstream of the document. It’s a default in Active Directory group policy that someone set in 2011. It’s a line in an auditor’s checklist that hasn’t been rewritten. It’s a compliance regime — PCI DSS enshrined the 90-day change for years before it relaxed — that a business follows to the letter because failing an audit costs money and following outdated-but-approved rules doesn’t. It’s the vendor default in an off-the-shelf product. Changing the standard is one committee’s decision. Changing every downstream artifact that inherited the old standard is a thousand small unglamorous edits that nobody is assigned to make.
So the rules sit there, finalized and ignored, while users keep rotating Winter2026! and quietly hating it.
What the whole saga is really about
The lesson isn’t “NIST was wrong, now they’re right.” It’s that the rules were never the security in the first place.
For twenty years we made users perform complexity and called it protection. The single change that does more than every composition rule combined — checking a new password against the billions already sitting in breach dumps — wasn’t even possible to enforce at scale until relatively recently, and it’s the quiet centerpiece of the 2025 document. Not because it makes users jump through hoops, but because it does something an attacker actually cares about: it refuses the passwords they already have.
If you run an authentication system, the move is unglamorous and well-defined. Drop the composition requirements. Stop the forced rotations. Raise the minimum length and steer people toward passphrases. Screen every new password against a compromised-password list. Kill the security questions. It’s less work than what you’re doing now, and it’s finally what the standard says.
The rules are final. The only thing left is for the rest of us to catch up to a document that’s been telling us the answer since 2017.