Ahhh.... that's good, however, those guidelines don't follow current NIST standards. Would it be possible to not have requirements around complexity and just bump up the length to something like 256?
However, additional research shows that requiring new passwords to include a certain amount of complexity can actually make them less secure. And thatโs why NIST has also removed all password-complexity requirements from their guidelines.For example, many companies require that users include special characters, like a number, symbol, or uppercase letter, in their passwords to make them harder to decrypt.
Unfortunately, many users will add complexity to their password by simply capitalizing the first letter of their password or adding a โ1โ or โ!โ to the end. And while it technically does make a password more difficult to crack, most password-crackers worth their salt know users tend to follow these patterns and can use them to reduce the time needed to decrypt a stolen password.
Additionally, as password complexity increases, users tend to reuse passwords from account to account, increasing the risk that they could be the victim of a credential stuffing attack if one account is breached.
So instead of forcing users to create more complex passwords, ask them to create longer ones if you want to improve password security.
