Your passwords don’t need so many fiddly characters, NIST says

The Malwarebytes piece reports that the US National Institute of Standards and Technology has published updated password guidelines that shift away from enforcing complex characters and frequent resets. It emphasises that password length now matters more than symbol or uppercase requirements, with 15-character passwords recommended for single-factor use and up to 64 characters possible in some cases, while regular resets are discouraged unless a password has been compromised.

The guidance also rejects password hints and basic security questions, favouring recovery codes or links instead, and introduces the concept of a blocklist to reject common or breached passwords. The article notes that the guidelines are guidance, not mandatory for everyday businesses, though they should be heeded by small organisations to reduce risk. It also quotes Verizon’s 2025 Data Breach Investigations Report, which claims credential abuse remains the most common vector in small business breaches.

Overall, the piece frames these changes as a practical shift in how organisations should manage password security and user authentication.