NIST Recommends New Rules for Password Security

NIST SP 800-63B updates recommend prioritizing password length (supporting long passphrases and Unicode), removing complexity requirements and periodic resets, and checking passwords against common/compromised lists; they also advise proper salted hashing, forbidding hints and knowledge-based questions, verifying full passwords without truncation, and encouraging MFA to improve security and usability across organizations.