SP 800-63B-4 distinguishes a password used alone from one used within multifactor authentication. A verifier must require at least 15 characters for the former; it may accept at least eight for the latter. The shorter threshold is not a recommendation to shorten an existing password.

The document rejects arbitrary composition rules and routine forced password changes. A change is still required when there is evidence of compromise. Administrators should therefore separate calendar-based expiry from incident response, rather than disabling both together.

Length is only one control. Screening prospective passwords against commonly used or compromised values and limiting failed attempts remain important. A password that satisfies a character counter can still be predictable or already exposed.

At assurance level AAL2, applications must offer a phishing-resistant authentication option. This is not the same as saying every second factor resists phishing: a code typed into a fraudulent page can be relayed. Buyers should ask what authentication method and recovery process a service actually supports.

Treat this as a procurement checklist: minimum length by sign-in context, compromised-password screening, recovery and a phishing-resistant option. NIST guidance has a defined scope; it is not automatically a legal obligation for every private website or country.

Editorial note: manufacturer specifications are not independent test results. Source links are references, not purchase recommendations.