Why ‘password1’ Passes and What NIST Requires

Despite being notoriously weak, “password1” often passes password strength meters because many systems only check length and character variety, not actual predictability. The National Institute of Standards and Technology (NIST) explicitly prohibits such simple, pattern-based passwords in its guidelines, instead requiring checks against breached password lists and a minimum length of 8 characters. This article explains why common passwords slip through, what NIST actually mandates, and how to implement better password policies.

Formula

The NIST compliance score is a simple additive metric based on four key requirements from NIST SP 800-63B. Each criterion contributes points: minimum length ≥ 8 gives 3 points, maximum length ≤ 64 gives 2 points, checking against breached password lists gives 3 points, and not requiring complexity gives 2 points. The formula is:

Score = (min_len ≥ 8) × 3 + (max_len ≤ 64) × 2 + (breached_check) × 3 + (no_complexity) × 2

• min_len: the minimum number of characters a password must have (default 8).
• max_len: the maximum number of characters allowed (default 64).
• breached: 1 if the system checks against a list of known breached passwords, 0 otherwise.
• complexity: 1 if the system requires a mix of character types, 0 otherwise.

The maximum score is 10, representing full compliance with NIST’s core recommendations.

Worked Example

Using the default values from the calculator (min_len=8, max_len=64, breached=1, complexity=0):

1. Minimum length ≥ 8? Yes → 3 points
2. Maximum length ≤ 64? Yes → 2 points
3. Breached list check? Yes → 3 points
4. Complexity required? No → 2 points

Total = 3 + 2 + 3 + 2 = 10. This configuration fully meets NIST’s password guidelines.

Why “password1” Sails Through

Many websites still use the classic rule: at least 8 characters, and must include an uppercase letter, a lowercase letter, and a number. “password1” meets all those criteria: it has 9 characters, contains uppercase ‘P’, lowercase letters, and the digit ‘1’. So it passes the complexity check. But NIST’s guidelines explicitly state that such composition rules are not sufficient. They argue that “password1” is predictable and easily guessed, especially since it appears in every major breached password list.

The core issue is that complexity rules only measure the character set, not the predictability. A password like “P@ssw0rd” also passes complexity but is equally weak. NIST’s approach is to focus on what actually makes passwords hard to crack: length and randomness, not forced character variety.

What NIST SP 800-63B Actually Requires

NIST Special Publication 800-63B, the Digital Identity Guidelines, was updated in 2017 and remains the benchmark for password security. The key requirements are:

• Minimum length of 8 characters for user-chosen passwords (and 6 for PINs).
• Maximum length of at least 64 characters to allow passphrases.
• Check against a list of known breached passwords (e.g., Have I Been Pwned) and reject any match.
• No composition rules (no forced uppercase, digits, or symbols).
• No password hints or knowledge-based questions (like “What is your mother’s maiden name?”).
• Allow all printable ASCII characters plus spaces, and accept Unicode where feasible.
• No periodic forced resets unless there is evidence of compromise.
• Offer a “show password” option to help users avoid typos.
• Allow paste into password fields to support password managers.

These guidelines are designed to reduce user frustration and improve security simultaneously. For example, forcing users to change passwords every 90 days often leads to weaker passwords like “Password1!”, “Password2!”, etc. NIST recognizes that users will choose predictable patterns if forced to change frequently.

How to Choose a Strong Password (NIST-Approved)

Instead of trying to satisfy complexity rules, focus on length and uniqueness. Here are practical steps:

1. Use a passphrase: combine 4-5 random words, e.g., “correct horse battery staple” (as suggested by XKCD).
2. Make it at least 12-16 characters long. Length is the most important factor.
3. Use a password manager to generate and store unique passwords for each site.
4. Never reuse passwords across multiple accounts.
5. Enable two-factor authentication (2FA) wherever possible.

If you must choose a password without a manager, use a random string of words or a sentence that is meaningful only to you. Avoid using personal information like birthdays or pet names.

Common Misconceptions About NIST Guidelines

One common myth is that NIST requires special characters. Actually, NIST discourages composition rules because they often backfire. Another misconception is that NIST mandates password expiration. In fact, NIST recommends against forced periodic changes unless there is a known breach. Additionally, some believe NIST requires a minimum of 12 characters, but the official minimum is 8; however, NIST recommends 15 or more for high-security systems.

Another misunderstanding is that NIST’s guidelines only apply to government agencies. While they are mandatory for federal systems, they are widely adopted by private companies as best practice. Many major tech companies and security frameworks (like OWASP) align with NIST’s recommendations.

Frequently Asked Questions

Why does my bank still require complexity and periodic resets?

Many legacy systems and regulated industries (like finance) have not yet updated their policies to NIST’s latest guidelines. They often follow older standards or regulatory requirements that mandate complexity and periodic changes. However, this is slowly changing as more institutions recognize the benefits of NIST’s approach.

Does NIST require a minimum of 12 characters?

No, the official minimum is 8 characters. However, NIST recommends 15 characters for high-security contexts and encourages longer passwords. The 8-character minimum is a floor, not a target. Using 12-16 characters is a good practice.

How do breached password lists work?

Services like Have I Been Pwned collect passwords from data breaches and make them available via API. When a user sets a password, the system hashes it and checks it against the list (often using a technique called k-anonymity to avoid sending the full hash). If it matches, the password is rejected because it’s known to be compromised.

Is it okay to use spaces in passwords?

Yes, NIST explicitly allows spaces and all printable ASCII characters. Spaces can make passphrases easier to type and remember. For example, “correct horse battery staple” is a valid password.

What about password managers? Are they safe?

Password managers are generally safe and recommended by NIST. They allow you to use unique, complex passwords for every site without memorizing them. The main risk is the master password, which should be a long passphrase and protected with 2FA.

Conclusion

The reason “password1” passes many strength meters is that those meters are outdated. NIST’s guidelines are clear: focus on length, check against breached lists, and avoid arbitrary complexity rules. By following NIST’s recommendations, you can create passwords that are both more secure and easier to remember. Use the calculator above to evaluate your current password policy and see if it meets NIST standards.

Related

• Choose a Text Message AI Agent: Privacy, Tasks & Cost
• AT-LP60XBT vs AT-LP60X: Which Turntable?
• Google Antigravity vs Claude Desktop: Mac AI Assistant

in min_len | Minimum length | characters | 8 | 0 | 64
in max_len | Maximum length | characters | 64 | 8 | 128
in breached | Check against breached lists | 1=Yes, 0=No | 1 | 0 | 1
in complexity | Require complexity (upper, lower, digit, symbol) | 1=Yes, 0=No | 0 | 0 | 1
out score | NIST compliance score | /10 | (min_len>=8)*3 + (max_len