Use long, unique passwords

Editorial update: 21 September 2026. Introductory learning material.

Use a different password for each account, generated and stored in an approved password manager where possible. Favor length and unpredictability; do not reuse a company password on personal services.

NIST SP 800-63B-4 sets a 15-character minimum for single-factor passwords. It permits a minimum of eight when the password is used only as part of MFA. These are requirements for authentication-system providers within that guidance, not a claim that every business system has identical rules.

NIST advises against arbitrary periodic password changes and composition rules. Change a password when it is compromised or suspected compromised, and follow applicable system, contractual and organizational requirements.

Activity: Check your password manager and MFA coverage without recording passwords in the exercise.

Reference: NIST SP 800-63B-4, password requirements. Check the source and your system provider’s current instructions before implementation.