NIST Drops Password Complexity, Mandatory Reset Rules

Per the NIST SP 800-63-4 draft, credential service providers and verifiers shall not require specific character-type composition or periodic password changes; instead they should require a minimum of 8 characters (15 recommended), allow passwords up to at least 64 characters including ASCII/Unicode, stop using knowledge-based authentication, and only force password changes when there is evidence of compromise.