NIST SP 800-63B-4 Password Guidelines for Businesses

Reviewed August 15, 2026. NIST SP 800-63B-4 superseded the prior SP 800-63-3 guidance in 2025. It is a federal digital-identity guideline, not a new Dallas-specific law. Businesses can use it as a strong technical reference, but applicable contracts, industry rules, cyber-insurance terms, and platform capabilities still require separate review.

The current password-verifier requirements emphasize length, blocklists, rate limiting, password-manager usability, and secure storage instead of forced character-composition rules or arbitrary periodic changes. Passwords are not phishing-resistant, so stronger authenticators and MFA remain necessary.

Implement the current verifier rules

Apply the rule that matches how the password is actually used. A platform that calls a login “MFA capable” but permits password-only access is not automatically entitled to the shorter MFA minimum.

Protect the verifier

NIST's upper bound of 100 consecutive failed attempts is not a recommendation to allow 100 rapid guesses. Risk-based systems may impose lower effective limits while balancing denial-of-service and recovery concerns.

• Use authenticated protected channels when requesting passwords.
• Rate-limit failed authentication attempts and monitor abusive patterns.
• Salt and hash passwords with a suitable approved password-hashing scheme and a practical work factor.
• Store any additional keyed hashing or encryption secret separately in protected hardware where used.
• Never store plaintext passwords, reversible password hints, or security questions as an alternate secret.

Pair passwords with stronger authentication

NIST explicitly states that passwords are not phishing-resistant. Prefer phishing-resistant authenticators such as properly deployed WebAuthn-based credentials where the required assurance and platform support justify them.

Inventory service accounts, legacy protocols, local devices, applications, and recovery flows that can bypass the main identity provider. A modern cloud sign-in policy does not remediate an old protocol or unmanaged local account automatically.

Roll out without locking out the business

Do not silently weaken an application that cannot support the intended controls. Record exceptions, compensating controls, owners, and retirement dates.

1. Inventory every password policy, verifier, identity provider, legacy protocol, and recovery path.
2. Compare current controls with NIST and any binding sector or customer requirements.
3. Pilot changed minimums, blocklists, paste, autofill, Unicode, and recovery behavior.
4. Communicate why composition and routine rotation rules are changing while MFA requirements may increase.
5. Measure lockouts, recovery, weak-password rejection, MFA coverage, legacy authentication, and help-desk impact.

Implementation and review gate

Identity and legal reviewers must verify the final policy against the exact NIST text and all binding requirements. Do not describe the guidance as a universal law or imply that password rules alone deliver an assurance level.

ITECS can help Dallas organizations plan and validate this work through cybersecurity services. Product, legal, security, and compliance decisions remain subject to the organization’s current requirements and the named review gate below.

Primary sources

• NIST SP 800-63B-4
• NIST: authenticator requirements
• NIST: strength of passwords
• NIST SP 800-63B change log