Password Policy Best Practices

Strong password policies balance security and usability. Current NIST guidelines (NIST SP 800-63B) have moved away from complex rules (mandatory special characters, forced 90-day rotation) toward longer passwords and checking against breached password lists. Recommended policy: minimum 12–16 characters, no mandatory complexity rules (complexity encourages weak patterns like Password1!), no arbitrary expiration (only require changes when a breach is suspected), and prohibit commonly used or previously breached passwords. Use HIBP (Have I Been Pwned) integration or Microsoft's banned password list to block known compromised passwords. In Active Directory, configure password policies via Group Policy (Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy). For Microsoft 365, use Azure AD password protection to enforce banned password lists. The most important supplement to password policy is MFA — even a weak password is significantly harder to exploit when MFA is required. Encourage use of a password manager (Bitwarden, 1Password, Microsoft Authenticator) so users can maintain unique, strong passwords for every account.