NIST Recommends Some Common-Sense Password Rules

NIST’s draft SP 800-63-4 recommends modernizing password policies: require at least 8 characters (preferably 15), permit up to 64 characters, accept all printable ASCII and Unicode, avoid composition rules and periodic resets except after compromise, prohibit password hints and knowledge-based security questions, and verify the full password without truncation. The post also notes potential security concerns with allowing arbitrary Unicode in passwords.