Password Policy That People Actually Follow

Why traditional password policies fail

The classic password policy — minimum eight characters, at least one uppercase, one lowercase, one number and one symbol, changed every ninety days — creates predictable behaviour. Employees choose Password1!, change it to Password2! next quarter and write them on sticky notes under their keyboards.

This is not a people problem. It is a policy problem. When the rules make it impossible to remember passwords without writing them down, people write them down. When forced to change passwords regularly, people make predictable modifications that attackers guess instantly.

The result is the worst of both worlds: passwords that are hard for humans but easy for computers. A policy that works with human psychology rather than against it produces better security outcomes.

NIST guidelines: length over complexity

The US National Institute of Standards and Technology (NIST) published updated password guidelines in SP 800-63B that fundamentally changed the approach. The key recommendations are straightforward and evidence-based.

Length matters more than complexity. A password's resistance to brute-force attacks grows exponentially with length. A fourteen-character passphrase of lowercase words is harder to crack than a ten-character password with every special character. NIST recommends a minimum of eight characters for user-chosen passwords and encourages longer ones.

Stop forcing periodic changes. Unless you have evidence that a password has been compromised, do not require users to change it. Forced rotation creates weaker passwords and more help desk calls.

Screen against common passwords. Before accepting a password, check it against a list of known compromised passwords (available from Have I Been Pwned and other sources). The most effective security filter is simply rejecting the five hundred most common passwords.

Encourage passphrases. Four random words joined by hyphens or spaces — for example, blue-bicycle-jungle-clock — create a password that is both strong and memorable. The image-based mnemonic is far easier to recall than a random string.

Implementing these guidelines is cheap. Most authentication systems, including Active Directory, Google Workspace and Microsoft 365, support custom password policies that follow the NIST model.

MFA implementation

Multi-factor authentication is the single most effective defence against credential theft. Microsoft reports that MFA blocks 99.9% of automated attacks. For any business handling customer data or financial transactions, MFA is not optional.

The least disruptive MFA method is an authenticator app (Google Authenticator, Microsoft Authenticator, Authy) that generates time-based codes. SMS-based MFA is better than nothing but vulnerable to SIM-swapping attacks. Hardware keys (YubiKey, Google Titan) are the most secure option and are appropriate for administrative accounts.

Roll out MFA in phases to avoid support overload. Start with administrative staff and finance teams, then expand to all employees over four to six weeks. Provide clear instructions and a support channel for users who need help setting it up.

For customer-facing systems, offer MFA as an option rather than a requirement unless your industry regulations mandate it. Many customers will not enable it, but those who do are adding a layer of protection at no cost to you.

Password managers

Password managers solve two problems simultaneously: they generate and store unique, strong passwords for every account, and they eliminate the need to remember them. An employee using a password manager has better password hygiene than one who is not, regardless of how good the password policy is.

Choose a business-grade manager that supports centralised administration, policy enforcement and secure sharing. Bitwarden, 1Password and Keeper all offer business plans with these features. Integrate with your single sign-on provider if you use one.

The most common objection — "what if the password manager itself is breached?" — is largely theoretical for reputable providers. Your vault is encrypted with a master password that the provider never sees. The real risk is a weak master password, so require a strong passphrase and MFA on the password manager itself.

Account lockout policies

Account lockout prevents attackers from trying thousands of passwords against a single account. A good lockout policy stops automated attacks without creating help desk tickets for legitimate users who mistype their password.

Set the threshold at five to ten failed attempts within a fifteen-minute window. Below five, legitimate users trigger lockouts too often. Above ten, attackers get too many attempts before being blocked.

Auto-unlock after fifteen to thirty minutes rather than requiring administrator intervention. Manual unlock creates a support burden that scales with headcount. Auto-unlock is a minor inconvenience for an attacker and invisible to legitimate users.

Log all failed attempts and review them periodically. A sudden spike in failed attempts against a single account — or a distributed attack against many accounts — is an early warning sign that needs investigation.

Employee training

The best password policy does not matter if employees do not understand it. Training should be short, practical and repeated. A thirty-minute session — or better, an interactive module — that covers the three key points is more effective than a printed policy document that nobody reads.

Use a password manager. Show employees how to install it, generate passwords and retrieve them when needed. Make it clear that the company expects passwords to be managed through the tool, not memorised.

Recognise phishing. Most credential theft happens through phishing, not brute force. Teach employees to recognise suspicious emails, never click links they were not expecting and always verify the URL before entering credentials.

Report incidents immediately. Remove the stigma around mistakes. An employee who reports a phishing click within minutes can have their credentials reset before any damage is done. An employee who hides it out of embarrassment creates a much bigger problem.

Run simulated phishing campaigns quarterly to measure progress. Quarterly training combined with simulated phishing reduces successful phishing rates from 20% to below 5% within a year.