Passwords are still the most common way people authenticate, and weak or reused ones remain one of the easiest and most common attack vectors. In a 2026 All About Cookies survey of 1,000 U.S. adults, 59% said one of their passwords has appeared in a data breach, and 41% of those people kept using it anyway.

Best password practices in 2026 come down to four fundamentals: length over complexity, a unique password for every account, a password manager to make that possible, and phishing-resistant multi-factor authentication (MFA) or a passkey wherever it's offered.

Below we cover NIST's latest password guidance, where passkeys fit into a modern password policy, and how to write one for your organization, plus a free, customizable password policy template to get started.

Passwords alone are a weaker front door than they used to be, but they're still a door. In the 2026 Verizon Data Breach Investigations Report, vulnerability exploitation overtook stolen credentials as the leading way attackers get in for the first time in the report's 19-year history. But credential abuse hasn't gone away: it still shows up in 39% of breaches across the full attack chain and was the first recorded action in 13% of them.

As a result, regulations and guidance today urge organizations to combine password hygiene with other authentication methods to truly enhance their defenses. For example, the Department of War's "Brilliant at the Basics" campaign included a ranked top-10 list of IT best practices for defense contractors and the single highest-priority item on that list: phishing-resistant MFA. DoW's guidance specifically calls out moving away from legacy MFA methods like SMS codes and push notifications, which attackers have gotten good at defeating, in favor of authentication that can't be phished at all.

The latest version of NIST’s Digital Identity Guidelines, NIST SP 800-63B-4, includes a whole section on phishing resistance. Let’s take a closer look at this publication detailing the latest best practices for creating strong passwords and authentication processes.

NIST recently updated its Digital Identity Guidelines, releasing NIST Special Publication 800-63B-4, in July 2025 and superseding SP 800-63B (2020). Its core shift in password security is prioritizing length and breach screening over composition rules, which reflects a decade of research showing that complexity requirements and frequent resets push users toward predictable workarounds rather than stronger passwords.

However, strong passwords is only one type of authenticator that can be used to provide what NIST refers to as “reasonable risk-based authentication assurance” (ie. confidence that the subject accessing the service today is the same as the one who previously accessed the service).

NIST categorizes how combinations of authenticators can be used together into three Authenticator Assurance Levels (AALs). The higher the AAL, the stronger the authentication and risk reduction and the higher the technical requirements. Here’s how to meet each level:

• AAL1 permits any one authenticator type, including a password alone, and provides basic confidence.
• AAL2 requires a second factor (such as a recovery key plus a password) and recommends but does not require phishing-resistant methods, providing high confidence.
• AAL3 permits a password as long as a cryptographic authenticator with a non-exportable private key that provides phishing resistance (such as a hardware-based FIDO2 key plus a device-bound passkey) is also used, providing very high confidence.

While passwords can still play a role at every level, they cannot meet the technical requirements of higher assurance levels alone. Let’s take a look at current password and other authentication best practices below, and how they’ve changed since the last revision.

Set a length-based minimum, not a complexity requirement

User passwords should be long rather than complicated. Under SP 800-63B-4, a password used as the only login factor needs at least 15 characters; one used alongside MFA can be as short as 8. Systems should support passwords up to at least 64 characters, so don't cap length artificially.

Instead of enforcing rigid complexity or composition rules, encourage users to create longer or more complex passwords using whatever characters they want. The result is typically easier to remember and harder to guess than passwords created with mandatory mixed case or special character types, which tend to be forgotten and frustrate users without significantly reducing risk.

Try the three random words method for memorable, compliant passwords

The UK's National Cyber Security Centre recommends building a password from three random, unrelated words strung together (something like "turbosnailyellow") instead of a single word with symbols bolted on. The result is usually longer than most people would otherwise choose, which helps it clear the 15-character single-factor floor, while staying easier to remember than a traditional complex password.

The catch is in the word "random." Predictable combinations, like a pet's name plus a favorite color, or common word pairings, can still turn up in breach data and get caught by blocklist screening. The method works best paired with a password manager, which removes the need to remember more than one strong password (the one protecting the manager itself) in the first place.

Screen every password against known-breached and common passwords

All passwords should be checked against a blocklist of weak, common, or previously compromised passwords, including breached-credential databases, dictionary words, and predictable choices like the service's own name or “Password1!”. Integrate a password strength check or generator at the point of creation so users get real-time feedback instead of finding out after the fact that their choice was rejected.

Drop forced password rotation

Frequent and “arbitrary” password changes tend to produce worse passwords, not better ones, since users respond by making small predictable tweaks to a password they already know. Reset a password only when there's evidence of compromise or if a user requests it. If you're managing high-privilege accounts and want an extra layer of caution, a periodic reset may still make sense, but it shouldn't be your default policy for every account.

Require phishing-resistant MFA and passkeys

A password, however strong, is still a shared secret that can be phished. That’s why several key government directives, regulations, and industry standards including CMMC, Australia's Essential 8, OMB Memorandum M-22-09, DORA, NIS2, and DoW's Brilliant at the Basics guidance require or recommend going passwordless and adopting phishing-resistant MFA.

Passkeys are one of the clearest ways to meet that requirement. A passkey is a FIDO authentication credential that lets a user sign in with the same biometric, PIN, or pattern they already use to unlock their device, with no password or one-time code involved. Because there's no shared secret to steal, passkeys are phishing-resistant by design. SP 800-63B-4 formally recognizes them as satisfying:

• AAL2 if synced (meaning credentials are stored in a cloud-backed credential manager and synchronized across multiple devices) and
• AAL3 if device-bound (meaning the private key is stored in a hardware security module and cannot be exported or copied).

A practical policy should offer passkeys wherever the platform supports them, treat them as a preferred option rather than a mandate since not every vendor supports them yet, and keep strong password-plus-MFA requirements in place as the fallback everywhere else. Confirm with your framework or auditor whether passkeys currently satisfy your specific compliance requirement, since some regulatory regimes are still catching up to the standard.

Building a password policy your team will actually follow takes five steps: understand your requirements, assess your specific risks, draft the policy, roll it out with context, and revisit it on a schedule.

1. Understand your organization's needs.

Start by assessing your organization's specific requirements, including any regulatory or framework compliance, business objectives, and operational needs. A good password policy supports productivity without imposing unnecessary friction on users.

Include stakeholders from various departments to ensure your policy is both comprehensive and practical:

• IT and cybersecurity can lead the policy creation process and provide technical expertise.
• Compliance and legal can ensure alignment with applicable regulations.
• HR can incorporate the policy into employee onboarding and security awareness training initiatives.
• Operations can ensure the policy is practical and user-friendly.
• Executive leadership can secure buy-in for enforcement and company-wide adoption.

2. Evaluate risks and set objectives.

Look honestly at where your organization is exposed. Are employees reusing passwords or storing them insecurely? Do your current systems support modern authentication like MFA and passkeys? Which credential threats, phishing, credential stuffing, or something else, are most relevant to your environment?

Use what you find to decide what the policy needs to accomplish: stronger access controls, fewer compromised accounts, compliance with a specific standard, or all three.

3. Write the policy.

Draft the policy around the NIST-based practices above and the objectives from step 2, focusing on usability since an overly restrictive policy invites workarounds.

Pilot it with a small group before rolling it out company-wide, and gather feedback on real-world friction points before finalizing. Once it's ready, present the draft to leadership and connect it explicitly to business goals, security posture, and compliance requirements.

Don't want to start from a blank page? Download our free password policy template, built around current NIST guidance and customizable for your organization.

4. Communicate and implement the policy.

A policy only works if people understand and adopt it. Distribute it through multiple channels, explain the reasoning behind it rather than just the rules, and make sure employees know how to access a password manager, passkey setup, and any required training.

Tying password security into a broader security awareness conversation reinforces why it matters instead of treating it as one more rule to follow.

5. Review and update the policy on a schedule.

Monitor compliance through system audits and access reviews, address violations promptly, and offer ongoing training. Revisit the policy at least annually, and sooner if NIST issues new guidance or you experience a known incident.

Use this checklist to audit your current password policy and authentication processes against current authentication guidance:

A strong password policy is one layer of access management, not the whole strategy. We'll cover a few others worth building alongside it as part of a roadmap to improve your overall cybersecurity posture and operational resilience:

Adopt role-based access controls (RBAC).

RBAC ensures employees only have access to the resources they need for their specific roles, reducing the risk of unauthorized access and limiting the potential damage from a compromised account. Regular reviews of role-based permissions keep access aligned with job responsibilities and help you catch outdated or excessive privileges before an assessor or an attacker does.

Use privileged access management (PAM).

Privileged accounts, like admin credentials, are high-value targets for attackers. PAM protects them by enforcing stricter controls: requiring MFA for all privileged accounts, monitoring and logging account activity to detect anomalies, and using just-in-time access to grant elevated privileges only for specific tasks and timeframes. Together, these practices significantly reduce the risk of privilege abuse.

Monitor and audit access activity continuously.

Identifying vulnerabilities before they're exploited depends on visibility into what's actually happening across your environment. Real-time monitoring flags suspicious behavior, like multiple failed login attempts or logins from unusual locations, while it's still actionable rather than after the fact.

Implement a Zero Trust approach.

Zero Trust assumes every access request could be malicious, even from inside your organization, and requires authentication and authorization for every attempt regardless of location or device. Network segmentation restricts lateral movement if a breach does occur, containing potential damage to isolated areas instead of letting it spread.

Adopt a cybersecurity automation platform.

A security and compliance automation platform can simplify and strengthen access management by centralizing key processes. Platforms like Secureframe allow you to:

• Track and review employee access to specific applications, including their roles, privilege levels, and the status of MFA or single sign-on.
• Ensure timely updates to access permissions during onboarding, role changes, or terminations, reducing risks associated with outdated credentials.
• Continuously monitor systems, ensuring compliance with internal policies and external regulations.
• View real-time access and compliance reports, making audits faster and more accurate.

Ready to take access management to the next level at your organization? See how Secureframe automates password and other policy management, MFA, access monitoring, device management, and other identify and access requirements across your compliance program.