== NIST password standard

The NIST password standard (also known as the https://pages.nist.gov/800-63-3/sp800-63b.html[Special Publications (SP) 800-series]) is a guideline that provides recommendations for implementing secure password systems.

=== Password rules
Here are some of the most important recommendations made by the most recent NIST standard:

- *no composition rules* +
  Do not request the user to e.g. use at least one upper case letter and a special character on their password.
  Give them the opportunity to, but do not force them!
- *no password hints* +
  If you wanted people have a better chance at guessing your password, write it on a note attached to your screen.
- *no security questions* +
  Security questions, also known as knowledge-based authentication (KBA) are outdated.
  Asking a user “What’s the name of your pet?” or something similar to check if it’s really him, is pretty unsecure.
- *no unnecessary changing of passwords*
  If you want users to comply and choose long, hard-to-guess passwords, you should not make them change those passwords unnecessarily after a certain period of time.
- *minimum size of 8 characters* +
  A secure password nowadays should be at LEAST 8 characters long (up to 64).
  This is a minimum, not a maximum minimum!
- *support all UNICODE characters* +
  You should allow all kind of UNICODE characters in a password.
  This also includes emojis and whitespaces.
- *strength meter* +
  Add a strength meter on the password creation page to help the user to choose a strong and secure password.
- *check the password against known bad choices*
  * passwords obtained from previous breach corpuses
  * dictionary words
  * repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’)
  * context-specific words, such as the name of the service, the username, and derivatives thereof

=== Usability

Besides the recommendations above, the NIST standard also recommends to increase the usability of password forms to increase the likelihood of users choosing a strong and secure password. Some of those are:

- *allow pasting into the password input* +
  Users should be able to use the "paste" functionality when entering a password.
  Since this facilitates the use of password managers, it also increases the likelihood that the user will choose a strong password.
- *allow to display the password* +
  Password inputs should have an option to display the entered password to assist the user in successfully entering a password.
- *offer a strength meter* +
  Add a strength meter on the password creation page to help the user to choose a strong and secure password.