Password Complexity Requirements Did Not Make Passwords Stronger. NIST Reversed Its Guidance in 2017.

How the Old Rules Were Born and Why They Failed

In 2003, a NIST employee named Bill Burr wrote an eight-page document called NIST Special Publication 800-63. It became one of the most influential and most regretted pieces of technical writing in the history of the internet. Burr's guidance recommended that organizations require passwords to contain a mix of uppercase letters, lowercase letters, digits, and special characters, and that users change their passwords every 90 days. Those rules were adopted almost universally by corporate IT departments, government agencies, and consumer websites throughout the 2000s.

Burr later acknowledged publicly that he had written the document without access to good data on how people actually chose passwords. He based the complexity rules on a 1980 paper about mainframe security that was never designed for web-era authentication. By the time researchers began studying large collections of real-world password data, the picture was clear: people systematically game whatever rules they are given. When forced to add a capital letter, they capitalize the first letter. When forced to add a number, they append 1 or 123. When forced to add a special character, they use! at the end. When forced to change passwords every 90 days, they increment a digit.

The 2017 NIST revision explicitly cited this research. Section 5.1.1.2 of SP 800-63B states that composition rules "provide less benefit than might be expected because users tend to use predictable methods for satisfying these requirements when imposed." Mandatory rotation was also removed because it consistently produced weaker passwords, not stronger ones. Users forced to change passwords frequently reuse slight variations, which are trivial for attackers who already have one version of the password in a breached database.

Why Length Wins: The Entropy Math

The mathematical case for length over complexity comes from information entropy. Entropy is measured in bits and represents the number of equally likely possibilities an attacker must consider. Each additional character multiplies the search space by the size of the character set used. Increasing length compounds that multiplication at a faster rate than switching between character classes.

A 12-character password using only lowercase letters has 26 raised to the 12th power as its search space, roughly 95 trillion possible combinations. A 10-character password that satisfies the old complexity requirements, drawing from a 94-character set of printable ASCII characters, has 94 raised to the 10th power, roughly 53 trillion combinations. The longer lowercase password is harder to brute-force despite using a smaller character set. Add two more characters to the lowercase password and the gap widens dramatically.

The formula for entropy is: entropy in bits equals the password length multiplied by log base 2 of the character set size. For practical purposes, a password using only lowercase letters gains about 4.7 bits of entropy per character. A password using the full printable ASCII set gains about 6.6 bits per character. The difference per character is real, but length compounds faster.

The phrase "correct horse battery staple," illustrated in a 2011 xkcd comic and widely discussed by security researcher Bruce Schneier, demonstrated this principle concretely. Four random common words strung together produce roughly 44 bits of entropy from the randomness of word selection alone. The phrase is 28 characters, memorable, and resistant to dictionary attacks because no attacker's wordlist is likely to contain that exact four-word combination.

How Modern Password Strength Checkers Actually Work

The gap between naive complexity scoring and real strength measurement became a practical problem for engineers building user-facing authentication systems. A password like Tr0ub4dor&3 would score highly on any rule-based checker because it has uppercase, lowercase, numbers, and a special character. But it appears in Mark Burnett's 2011 collection of 10,000 most common passwords, meaning any serious attacker would try it in the first few seconds.

In 2012, Dropbox engineer Dan Wheeler released zxcvbn, a password strength estimator that treats strength as a question of guessing difficulty rather than rule compliance. Wheeler built the tool during a Dropbox hackweek and deployed it directly on Dropbox's registration page. The approach was fundamentally different from what existed before.

Instead of checking which character classes a password contains, zxcvbn uses three sequential processes. First, it runs pattern matching across the password to identify dictionary words, keyboard spatial patterns like qwerty or asdfgh, date formats, repeated characters, and sequences. Second, it calculates entropy independently for each matched pattern. Third, it uses dynamic programming to find the minimum-entropy combination of non-overlapping patterns, which is the sequence of guesses an attacker would most efficiently exploit.

The data sources Wheeler built into zxcvbn included 10,000 common passwords from Burnett's research, 40,000 English words drawn from frequency analysis of television and movie scripts, and US Census data on first names and surnames ranked by frequency. The result is an estimator that correctly rates "correcthorsebatterystaple" as strong while correctly flagging "Tr0ub4dor&3" as weak, because one has never appeared in a leaked database and the other has.

The threat model zxcvbn was designed around assumes offline attacks against salted password hashes with roughly 100 parallel CPU cores attempting 10 milliseconds per guess. That assumption matters because online attacks, where a server rate-limits login attempts, and offline attacks, where an attacker has already obtained a hashed copy of the password database, have very different difficulty profiles.

What NIST Now Requires and What It Means in Practice

The 2025 Revision 4 of NIST SP 800-63B refined the 2017 guidance further. The current requirements for what NIST calls memorized secrets establish a minimum length of eight characters, with explicit encouragement for users and systems to support passphrases of 15 characters or more. Systems are required to accept passwords up to at least 64 characters. Composition rules are explicitly not recommended. Mandatory rotation is only appropriate when there is specific evidence of compromise.

Conclusion

The most significant addition in recent revisions is the requirement to screen new passwords against a blocklist of commonly used and previously breached passwords. This is the practical application of research from organizations like Troy Hunt's Have I Been Pwned project, which by 2024 had cataloged over 12 billion breached account credentials. A password that has appeared in any known data breach should be rejected regardless of its theoretical entropy, because attacker wordlists are built from real breach data.

NIST also explicitly recommends supporting copy-and-paste in password fields, reversing the counterproductive practice of disabling paste that many websites implemented under the mistaken belief it improved security. The reasoning is straightforward: if users cannot paste passwords, they are unlikely to use a password manager, and password managers are the most reliable way to generate and store high-entropy unique passwords for every service.

A practical concern with any online password strength tool is that testing a real password on a remote server defeats the purpose of having a strong password. The password itself becomes a piece of transmitted data that a sufficiently motivated attacker or a compromised service could capture.

Good password strength checkers run entirely in the browser. No data leaves the page. The entropy calculations described above can be performed locally using JavaScript implementations of algorithms like zxcvbn. When you type into the strength checker, the analysis happens on your device.

The strength indicator in a password checker reflects entropy calculations, not an arbitrary score. A 20-character passphrase made of three random words will score higher than an 8-character string that satisfies every complexity requirement from 2003. The score tells you what the math says, not what a particular website's rules require. Use the checker to measure the actual guessing difficulty of a candidate password before committing to it, and treat anything below 60 bits of estimated entropy as a password worth replacing.

Frequently Asked Questions

Try These Free Tools