# How long should a password be?

NIST SP 800-63B-4 requires 15 characters for a password used alone, 8 with a second factor, and no mixing rules. PCI DSS requires 12. CISA recommends 16.

Updated: October 16, 2026

Minimum password lengths in US guidance run from 8 to 16 characters. To compare them, check two more things each source says: whether a second factor changes the number, and whether you must mix character types. In this article a second factor means a check beyond the password, such as a code from an authenticator app. NIST calls this multi-factor authentication. The details are in [What is two-step verification?](/guides/shared-accounts/what-is-two-step-verification)

## Length and character rules by source

| Source | Written for | Minimum length | Character types | How strong the wording is |
| --- | --- | --- | --- | --- |
| NIST SP 800-63B-4, section 3.1.1.2 | Services that check passwords | 15 alone, 8 with a second factor | Mixing rules not allowed | Length "SHALL", mixing rules "SHALL NOT" |
| CISA, "Require Strong Passwords" | Small and medium businesses | 16 | A mix of upper and lowercase letters, numbers and symbols, or a passphrase of 5 to 7 unrelated words | Recommendation |
| PCI DSS v4.0.1, requirement 8.3.6 | Systems in scope for card data | 12, or 8 if the system can't support 12 | Both numbers and letters | Requirement |
| CIS Controls v8.1, safeguard 5.2 | Organizations running the CIS Controls | 14 without a second factor, 8 with one | Not specified | Best practice |

NIST and CIS both lower the minimum when a second factor is in use. CISA and PCI DSS give one number.

## What NIST SP 800-63B-4 requires

NIST SP 800-63B-4 is NIST's guideline for how services check who is signing in, published in final form in July 2025. Its password rules are in section 3.1.1.2. They're addressed to verifiers, the services that check the password, and CSPs, the organizations that issue and manage the accounts.

Length has two tiers. A password that's the only factor must be at least 15 characters ("SHALL"). A password used with a second factor may be shorter ("MAY"), but still at least 8 ("SHALL"). For the upper end, services should accept at least 64 characters ("SHOULD").

Services shall not impose composition rules, such as requiring a mix of character types. The same section asks for two more things. Services shall check new passwords against a blocklist of common, expected or compromised passwords. And they shall allow password managers ([What is a password manager?](/guides/shared-accounts/what-is-password-manager)) and autofill.

The previous version, from 2017, set one minimum of 8 characters ("SHALL") for passwords people choose. It said services "SHOULD NOT" impose composition rules. Revision 4 raised the minimum to 15 for a password used alone and turned the composition advice into a ban.

## What CISA, PCI DSS and CIS ask for

CISA, the federal cybersecurity agency, describes a strong password for small and medium businesses in three points. It's long, at least 16 characters. It's random, either a mix of character types or a passphrase of 5 to 7 unrelated words. And it's unique, used for one account only. CISA also recommends a company-wide password manager and phishing-resistant multi-factor authentication alongside strong passwords.

PCI DSS is the data security standard for payment card data, set by the PCI Security Standards Council. Version 4.0.1 replaced version 4.0 in 2024 and added or removed no requirements. Requirement 8.3.6 applies when passwords are used to meet requirement 8.3.1, which says every user must sign in with at least one factor. Such passwords must be at least 12 characters, or 8 if the system can't support 12. They must contain both numbers and letters. The 12-character rule was a best practice until March 31, 2025, and is now in force. Requirement 8.3.7 adds that a new password can't match any of the last four.

The CIS Controls are a set of security practices published by the Center for Internet Security. Safeguard 5.2 asks for unique passwords on all company systems. Its best-practice baseline is at least 8 characters for accounts with multi-factor authentication and 14 for accounts without it.

## Symbol rules and why NIST bans them

CISA lists symbols as one way to make a password random, next to passphrases. PCI DSS asks for numbers and letters. NIST bans mixing rules, and it explains why in Appendix A, "Strength of Passwords."

Appendix A calls length "a primary factor in characterizing password strength." It says people react to composition rules in predictable ways. Its example: someone who would have picked "password" is likely to pick "Password1" when told to add a capital and a number, and "Password1!" when a symbol is also required. Appendix A also warns that very complex passwords are harder to remember. So they're more likely to be written down or stored somewhere unsafe.

If you drop a symbol rule, add the length and the blocklist check that NIST asks for in the same section. On systems in scope for PCI DSS, requirement 8.3.6 still calls for both numbers and letters.

## Settle these before you pick a number

### Are you setting a system rule or an employee rule?

When you set the sign-in rules for a system your company runs, your company is the service checking the password. So NIST's section 3.1.1.2 maps directly onto those settings. On an outside service, the service sets the minimum length and character rules. What you control there is your company's rule for the passwords employees create on it.

### Can the account use a second factor?

NIST and CIS both set a lower minimum when a second factor is in use. So find out first whether the account can have one. On a shared account, the code may go to one person's phone, so nobody else can sign in, and the team may turn it off. The account then runs on the password alone, and NIST asks for 15 characters.

### Will people type it from memory?

CISA's answer to remembering long passwords is a password manager. On a shared account, everyone who uses it knows the same long password and types it in. Length protects against guessing, not against people who already know the password. What to do when someone who knows it leaves is covered in [Do passwords still need to be changed every 90 days?](/guides/shared-accounts/periodic-password-change)

### One way to decide

For systems you run, follow NIST: 15 characters, or 8 with a second factor, plus a blocklist check. If a system is in PCI DSS scope, its length rule is at least 12, and it must also require numbers and letters. For employee rules on outside services, a minimum of 16 characters meets both NIST's 15 and CISA's 16. Suggest passphrases instead of requiring symbols, since NIST bans mixing rules. For policy wording, see [A password policy template and how to write each section](/guides/shared-accounts/password-policy-template).


## Frequently asked questions

**Is an 8-character password long enough?**

Under NIST SP 800-63B-4, 8 characters is the floor only when the password is used with a second factor. A password used alone needs 15. PCI DSS allows 8 only on systems that can't support 12, and CISA recommends 16.

**Can we stop requiring symbols in passwords?**

NIST says services shall not impose rules that mix character types. If you drop them, add the length and blocklist check from the same section. Systems in PCI DSS scope still need both letters and numbers.

**Didn't NIST say 8 characters was the minimum?**

The 2017 version required at least 8 characters for passwords people choose. Revision 4, published in July 2025, raised the minimum to 15 when the password is the only factor.

**What if people can't remember long passwords?**

CISA suggests a passphrase of 5 to 7 unrelated words, or a company-wide password manager. NIST requires services to allow password managers and autofill.

## Sources

- [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025)](https://pages.nist.gov/800-63-4/sp800-63b.html)
- [NIST CSRC: SP 800-63B-4 (final), publication details](https://csrc.nist.gov/pubs/sp/800/63/b/4/final)
- [NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management (June 2017, updated March 2, 2020)](https://pages.nist.gov/800-63-3/sp800-63b.html)
- [CISA: Require Strong Passwords (small and medium businesses)](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-strong-passwords)
- [PCI SSC: PCI DSS v4.0 Self-Assessment Questionnaire C (requirement text for 8.3.1, 8.3.6 and 8.3.7)](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-C.pdf)
- [PCI SSC: Summary of Changes from PCI DSS Version 3.2.1 to 4.0 (Revision 1, May 2022)](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf)
- [PCI SSC blog: Just Published: PCI DSS v4.0.1](https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1)
- [CIS Controls Assessment Specification for Controls v8.1: CIS Control 5, Account Management](https://cas.docs.cisecurity.org/en/latest/source/Controls5/)

## How Junify handles this

**Doing this by hand** To keep shared accounts safe, you track who knows each password, and change it and send out the new one whenever someone leaves. You also keep a separate record of who did what under the same login.

**With Junify** With Junify, nobody has to memorize and type a shared account's long password. Change it to a long one when you add the account. Your admin keeps it, and the Junify extension fills it in at each sign-in. People never see the password, so you can set the length without thinking about who has to remember it. If the account uses an authenticator app, Junify enters that code too. Codes sent by text message or email aren't covered.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=shared-accounts&slug=password-length-recommendations)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [How 1Password and Junify differ for shared accounts](/guides/shared-accounts/1password-and-junify): 1Password fits storing and sharing each employee's own passwords. Junify fits shared accounts people should use without seeing the password. You can run both.
- [How Bitwarden and Junify differ for shared accounts at work](/guides/shared-accounts/bitwarden-and-junify): Bitwarden fits employees who keep their own passwords and share some with trusted coworkers. Junify fits shared accounts used without seeing the password.
- [Should employees save work passwords in the browser?](/guides/shared-accounts/browser-saved-passwords-at-work): Fine for a person's own work login, in a company-managed profile, on a device only they use. Avoid it for shared accounts, personal devices and personal sync.