Reviewed 4 September 2026. Use this checklist when creating passwords and reviewing your team’s account policy.
Password Strength: What the Math Can Tell You
Entropy (bits) = length × log₂(pool size)This calculation applies to independent, uniformly random choices from a known pool. It does not measure a password someone invented, a familiar quotation or a published example. Do not reuse passwords printed in guides.
| Random generation method | Calculated entropy |
|---|---|
| 16 characters from 62 letters and digits | About 95 bits |
| 20 characters from the same 62-character pool | About 119 bits |
| 6 independently selected words from a 7,776-word list | About 78 bits |
These are generation examples, not guaranteed cracking times. Real outcomes also depend on password reuse, the verifier’s storage and rate limits, and how an account is protected. Generate a unique password for each service and store it in your password manager.
NIST SP 800-63B-4: Password Verifier Checklist
The final 2025 publication distinguishes requirements from recommendations. This summary concerns password verifiers; generating a password alone does not establish compliance.
| Topic | Guidance |
|---|---|
| Minimum length | Require at least 15 characters for password-only authentication. A password used only within MFA may be shorter, but must have at least 8 characters. |
| Maximum length | Allowing at least 64 characters is recommended. |
| Composition and rotation | Do not mandate character mixtures or scheduled password changes. Require a change when there is evidence of compromise. |
| Blocklists | Reject commonly used, expected and compromised passwords. |
| Password managers | Allow managers and autofill; permitting paste is recommended. |
| Security questions | Do not use knowledge-based questions as password authentication. |
Source: NIST SP 800-63B-4, Password Verifiers.
MFA and Recovery
| Method | What to check |
|---|---|
| Passkeys and FIDO security keys | Support phishing-resistant authentication. Passkeys may be synced between devices or bound to one device; unlocking can use a PIN or biometrics. |
| Authenticator codes | Add another factor, but a code entered into a phishing page can still be relayed. Keep recovery options available. |
| SMS codes | Depend on control of a phone number and have additional risks. Prefer an available phishing-resistant option. |
See the FIDO Alliance passkey guide for supported authentication and recovery choices.
- Enable the strongest authentication option your account supports.
- Save recovery codes somewhere you can reach if your primary device is lost.
- Check the provider’s recovery instructions before changing devices.
- Review active sessions and revoke access you no longer recognize.
Team Policy Worksheet
Complete these organization-specific choices. They are not universal NIST requirements.
- Policy owner and review date: ____________________
- Approved password manager and sharing process: ____________________
- Accounts requiring MFA and permitted methods: ____________________
- Recovery owner and protected storage location: ____________________
- Incident contact and account-revocation process: ____________________
- Service-account secret lifecycle: ____________________
When access changes or compromise is suspected, follow your documented incident process. A departed employee’s access should be revoked; any shared secret they could still use needs review.
Use the Tools
Generate a new password or read how password length affects strength. Keep your real account passwords out of examples you share with others.