For years, official U.S. guidance told people to mix uppercase, lowercase, digits, and symbols, then rotate the result every 90 days. NIST's Special Publication 800-63B, published in 2017, threw most of that out — it now recommends long passwords screened against known breach lists over arbitrary complexity rules, and explicitly advises against forced periodic changes.
What password entropy is
Entropy is measured in bits and depends on the character set size and password length: entropy = log2(alphabet_size ^ length). A longer password with a smaller alphabet (say, lowercase letters only) can have higher entropy than a short password with a complex alphabet — which is part of why NIST 800-63B shifted its advice toward length.
Why NIST dropped the old complexity rules
The research behind 800-63B found that forced complexity and mandatory rotation actually push people toward predictable patterns — appending a digit or incrementing a suffix each cycle — which is easier for an attacker to model than it looks. Instead, NIST now recommends allowing very long passwords (up to at least 64 characters), permitting all printable characters, and checking new passwords against lists of previously breached credentials rather than requiring specific character types.
Why generators still mix character types
Many systems still require digits, capital letters, and special characters — this doesn't always increase real entropy, but it does defend against the simplest dictionary attacks and outdated policies that remain common outside of NIST-aligned systems. A good password generator balances length and alphabet variety against a target entropy level.
Why you'd need this
- Generating strong passwords for new accounts without relying on human memory.
- Understanding why "at least one digit and symbol" isn't the most important security factor.
- Estimating the real brute-force resistance of existing passwords.
Passphrases versus random characters
A passphrase made of several random dictionary words (for example, "correct-horse-battery-staple") can have higher entropy than a short password with special characters, while being far easier for a human to remember. For passwords stored in a password manager and never typed manually, this doesn't matter — random characters give higher entropy per character. But for the password manager's own "master password," which has to be memorized, a passphrase is often the more practical choice.