Why the Old Complexity Rules Were Wrong
For two decades, the dominant guidance was: use uppercase, lowercase, numbers, and symbols, and change every 90 days. NIST revised this in 2017 after research showed it produced predictable patterns. Password1! satisfies complexity rules but is trivially cracked. Test any password against common heuristics with our Password Strength Meter.
What NIST Actually Recommends Now
- Length over complexity: A 20-character passphrase of common words has more entropy than a 10-character random string with symbols.
- No mandatory periodic resets: Change passwords only when there is evidence of compromise.
- Check against known breached passwords: Compare against databases of previously breached credentials. A complex-looking password from a previous breach is worthless.
- Allow all printable characters including spaces: Passphrases like “correct horse battery staple” should be valid — they have extremely high entropy.
Password Entropy: The Mathematical Reality
Entropy in bits = log&sub2;(character_set_size ^ password_length). A 10-character password using only lowercase letters has approximately 47 bits of entropy. Adding uppercase and digits at the same length reaches approximately 60 bits. A 20-character lowercase passphrase reaches approximately 94 bits — far stronger despite “less complexity.” Modern crackers exhaust 60-bit passwords in hours on consumer hardware.