Standards explainer
NIST password rules 2026: check against breached passwords (SP 800-63B)
Updated August 2026 · independent comparison · primary sources linked
Modern NIST guidance (SP 800-63B) tells you to check new passwords against lists of known-breached passwords and reject any that match, and to stop the old habits of forced periodic changes and complex-character rules that pushed people toward weak, reused passwords. For a small business this means one high-value action: turn on breached-password blocking (built into Google Workspace and Microsoft 365), so no one can set a password that’s already circulating in breach dumps.
What NIST SP 800-63B actually says
The relevant guidance (in the password/“memorized secret” section) includes:
- Screen against breach corpora: when a user sets or changes a password, compare it against a list of values known to be compromised (from breaches, dictionaries, repetitive strings) and reject matches.
- Length over complexity: allow long passphrases; don’t mandate arbitrary character-composition rules.
- No routine forced expiry: don’t force periodic changes without a reason, change only on evidence of compromise.
- Allow paste & password managers: support usability so people choose strong, unique secrets.
Read the primary source: NIST SP 800-63B, Digital Identity Guidelines.
How this connects to leaked-credential monitoring
Prevention + detectionBreach-password screening is the prevention half (stop people using an already-leaked password); credential monitoring is the detection half (find out when a currently-used credential leaks). You want both. The free Pwned Passwords API from HIBP is a common way to implement the screening NIST recommends.
Turn it on (free, both major providers)
- Google Workspace: enforce password length/strength and enable password monitoring & alerts in the Admin console; require 2-Step Verification.
- Microsoft 365 / Entra ID: enable Entra Password Protection (blocks weak and banned passwords, including a custom banned list) and enforce MFA via security defaults or Conditional Access.
Both align you with 800-63B at no extra cost, and the FTC’s small-business guidance points the same direction.
Related toolBreachTrigger is the simplest way to get an early warning when a public-company vendor, cloud provider or partner you depend on discloses a breach: it watches U.S. SEC EDGAR every ~30 minutes and alerts you the moment a company files an Item 1.05 “material cybersecurity incident” 8-K. It does
not scan dark-web dumps for your own passwords, so it is not a like-for-like HIBP alternative, it solves a different problem: vendor and third-party breach early warning.
See BreachTrigger → (free weekly digest; instant alerts from $199/mo).
Frequently asked questions
What does NIST say about breached passwords?
NIST SP 800-63B says that when a user sets or changes a password, you should screen it against lists of known-compromised passwords (from breaches and dictionaries) and reject any match. It also advises favouring length over complexity, not forcing routine password expiry, and allowing password managers.
Does NIST still recommend forcing password changes every 90 days?
No. NIST SP 800-63B advises against routine forced expiry. Passwords should be changed on evidence of compromise, not on an arbitrary schedule, because forced periodic changes tend to produce weaker, predictable passwords.
How do I block breached passwords for free?
Use the breached-password protection built into your identity provider: Google Workspace password policies and monitoring, or Microsoft Entra Password Protection. Both can reject known-weak or banned passwords at no extra cost, implementing the screening NIST recommends.