A password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly. A password policy is often part of an organization's official regulations and may be taught as part of security awareness training. Either the password policy is merely advisory, or the computer systems force users to comply with it. Some governments have national authentication frameworks that define requirements for user authentication to government services, including requirements for passwords. NIST guidelines The United States Department of Commerce's National Institute of Standards and Technology (NIST) has put out two standards for password policies which have been widely followed. 2004 From 2004, the “NIST Special Publication 800-63. Appendix A,” advised people to use irregular capitalization, special characters, and at least one numeral. This was the advice that most systems followed, and was "baked into" a number of standards that businesses needed to follow. 2017 However, in 2017 a major update changed this advice, particularly that forcing complexity and regular changes is now seen as bad practice. The key points of these are: Verifiers should not impose composition rules e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters Verifiers should not require passwords to be changed arbitrarily or regularly e.g. the previous 90 day rule Passwords must be at least 8 characters in length Password systems should permit subscriber-chosen passwords at least 64 characters in length. All printing ASCII characters, the space character, and Unicode characters should be acceptable in passwords When establishing or changing passwords, the verifier shall advise the subscriber that they need to select a different password if they have chosen a weak or compromised password Verifiers should offer guidance such as a password-strength meter, to assist the user in choosing a strong password Verifiers shall store passwords in a form that is resistant to offline attacks. Passwords shall be salted and hashed using a suitable one-way key derivation function. Key derivation functions take a password, a salt, and a cost factor as inputs then generate a password hash. Their purpose is to make each password guessing trial by an attacker who has obtained a password hash file expensive and therefore the cost of a guessing attack high or prohibitive. NIST included a rationale for the new guidelines in its Appendix A. Aspects Typical components of a password policy include: Password length and formation Many