Best Password Practices for 2026: Policy Guide and Personal Tips

Updated September 2026. This guide now follows NIST’s current digital identity rules, SP 800-63B-4, finalized in July 2025. It covers what a business password policy should say and what individuals can do today.

Password advice has changed a lot. The old rules, such as “change it every 90 days” and “use one uppercase letter, one number and one symbol”, are now officially discouraged. They pushed people toward predictable passwords like Summer2025! without making accounts much safer.

Today’s best password practices are simpler: use long passwords, block ones that are already known to attackers, stop forcing routine changes, and add a second factor that can’t be phished. Where you can, replace passwords with passkeys.

Why password policy still matters

Stolen and weak credentials remain one of the most common ways attackers get in. Verizon’s annual Data Breach Investigations Report has repeatedly found credential abuse among the leading causes of breaches.

Most attacks on passwords don’t involve clever cracking. They rely on reused passwords from old breaches (credential stuffing), common passwords tried across many accounts (password spraying), and phishing pages that simply ask for the password. A good policy is built around those real threats.

Best password practices at a glance

• Length over complexity. Require at least 15 characters for passwords used on their own, and allow up to at least 64.
• No composition rules. Don’t require a mix of uppercase letters, numbers and symbols.
• No forced periodic changes. Require a change only when there’s evidence of compromise.
• Block known-bad passwords. Check new passwords against breached, common and context-specific lists.
• Support password managers. Allow paste and autofill.
• Turn on MFA everywhere, and prefer phishing-resistant options such as passkeys or security keys.
• Drop security questions and password hints.
• Limit failed attempts and store passwords salted and hashed.

What NIST SP 800-63B-4 says about passwords

NIST SP 800-63B-4 is the U.S. government’s standard for authentication. It isn’t legally binding on most private companies, but many security frameworks and auditors treat it as the reference point. Its password rules are the clearest statement of current best practice.

Length

When a password is the only factor, NIST requires a minimum of 15 characters. When the password is used as part of multi-factor authentication, the minimum is 8 characters. Systems should allow passwords of at least 64 characters so people can use long passphrases.

Systems should also accept spaces and Unicode characters, so a passphrase like correct horse battery staple (or one in any language) works.

No composition rules

NIST says verifiers shall not impose composition rules, such as requiring a mix of character types. These rules make passwords harder to remember but not much harder to guess, because people satisfy them in predictable ways.

No forced periodic rotation

NIST says verifiers shall not require users to change passwords periodically. They shall force a change when there is evidence of compromise, such as a password appearing in a breach dump or signs of account takeover.

Microsoft gives the same advice for Microsoft 365. Its password policy recommendations say the recommended setting is for passwords to never expire.

In practice, require a password change when:

• the password turns up in a breach dump or fails a breached-password check;
• there are signs of account takeover, such as unfamiliar sign-ins, new MFA devices or mailbox forwarding rules nobody set up;
• the password was shared, typed on an untrusted device or sent in plain text;
• someone who knew a shared or service-account credential leaves or changes role;
• a system or vendor that stored the password reports a breach.

Two other habits from older password change policies still hold up. Disable or reset credentials for accounts that are no longer used instead of leaving them active. And give privileged accounts stronger protection, such as phishing-resistant MFA, separate admin accounts and closer monitoring, rather than more frequent resets.

Check new passwords against a blocklist

When someone sets or changes a password, the system should compare it with a blocklist. NIST says the list should include passwords from previous breaches, dictionary words, and context-specific words, such as the service name or the user’s username.

If the password is on the list, reject it and explain why. Services like Have I Been Pwned’s Pwned Passwords let you check hashes of candidate passwords against hundreds of millions of breached passwords without sending the password itself.

Make password managers easy to use

NIST says verifiers should allow password managers and autofill, and should let users paste passwords. Blocking paste mostly pushes people toward short passwords they can type.

No hints or security questions

Password hints and knowledge-based questions (“What was your first pet’s name?”) are not allowed under SP 800-63B-4. The answers are often public or easy to guess.

Limit guessing and store passwords safely

Systems must limit failed login attempts; NIST caps it at no more than 100 consecutive failures on a single account. Passwords must be stored salted and hashed with a suitable password-hashing or key-derivation function, never in plain text.

MFA and passkeys: the other half of the policy

A strong password still can’t stop a convincing phishing page. That’s why multi-factor authentication (MFA) belongs in every password policy. Our guide to multi-factor authentication explains the basics.

Not all MFA is equal. NIST does not treat passwords, one-time codes or out-of-band approvals as phishing-resistant. Codes sent by SMS or voice call are classed as a “restricted” authenticator because of risks like SIM swapping. CISA’s phishing-resistant MFA fact sheet makes the same point and recommends FIDO-based authentication.

What are passkeys?

Passkeys are a password replacement built on the FIDO2/WebAuthn standards. Your device creates a key pair for each site. The private key stays on your device or in your password manager, and you unlock it with your fingerprint, face or device PIN.

Passkeys are phishing-resistant because each one is tied to the real website’s domain. A look-alike phishing site can’t use it. SP 800-63B-4 also covers syncable authenticators, so passkeys that sync through Apple, Google, Microsoft or a password manager are recognized.

A simple order of preference

1. Passkeys or hardware security keys (FIDO2/WebAuthn)
2. Authenticator app codes, or push approvals that require number matching
3. SMS or voice codes, only if nothing better is offered

A sample business password policy

Use this as a starting point and adjust it for your systems and compliance needs. It lines up with SP 800-63B-4 and fits the identity controls in common cybersecurity frameworks.

1. Scope. Applies to all staff, contractors and service accounts on company systems.
2. Length. Passwords used on their own must be at least 15 characters. Passwords used with MFA must be at least 8 characters, and 15 or more is encouraged. Systems must accept at least 64 characters, including spaces.
3. No complexity or expiry rules. We don’t require character mixes or scheduled changes.
4. Blocklist. New passwords are checked against breached, common and company-specific terms and rejected if they match.
5. Change on compromise. Passwords must be changed immediately when there’s evidence or strong suspicion of compromise.
6. MFA required for email, remote access, cloud consoles, admin accounts and anything holding sensitive data. Phishing-resistant MFA (passkeys or security keys) is required for administrators.
7. Password manager. The company provides an approved password manager. Reusing work passwords elsewhere is not allowed.
8. No sharing. Passwords are never shared by email, chat or sticky note. Shared accounts use the password manager’s sharing features.
9. Lockout and monitoring. Failed attempts are rate-limited and suspicious sign-ins are alerted on.
10. Offboarding. Accounts are disabled promptly when someone leaves, and shared credentials they knew are changed.

Tools such as identity providers, password managers and breach-monitoring services make most of this automatic. Our list of top cybersecurity tools covers some of the options.

Personal password tips

• Use a password manager and let it generate long, random passwords. CISA’s strong password guidance suggests at least 16 characters.
• Never reuse passwords. One breach shouldn’t unlock your other accounts.
• Use a passphrase for the few passwords you must remember, such as your password manager’s master password. Four to seven random, unrelated words works well.
• Switch to passkeys wherever your email, bank or social accounts offer them.
• Turn on MFA for email first, because email is the reset key for everything else. Our social media security guide covers locking down social accounts.
• Check for breaches and change any password that shows up in one.
• Don’t answer security questions truthfully if a site still forces them. Store random answers in your password manager.

Outdated practices to drop

• Forcing password changes every 30, 60 or 90 days
• Requiring uppercase letters, numbers and symbols
• Short maximum lengths or banning spaces
• Blocking paste into password fields
• Password hints and security questions
• Relying on SMS codes for high-risk or admin accounts

For a quick weekday rundown of new breaches, scams and security advice, sign up for the CyberExperts Daily Brief.

Frequently asked questions

Sources

• NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025): csrc.nist.gov and pages.nist.gov
• Microsoft, Password policy recommendations for Microsoft 365: learn.microsoft.com
• CISA, Implementing Phishing-Resistant MFA (fact sheet): cisa.gov
• CISA, Use Strong Passwords: cisa.gov
• CISA, More than a Password (MFA): cisa.gov/MFA
• FIDO Alliance, Passkeys: fidoalliance.org
• Have I Been Pwned, Pwned Passwords: haveibeenpwned.com
• Verizon, Data Breach Investigations Report: verizon.com

George Mutune

I am a cyber security professional with a passion for delivering proactive strategies for day to day operational challenges. I am excited to be working with leading cyber security teams and professionals on projects that involve machine learning & AI solutions to solve the cyberspace menace and cut through inefficiency that plague today's business environments.