You Might Not Need Complex, Alphanumeric Passwords After All NIST now recommends using long passphrases instead of complicated alphanumeric passwords, and only refreshing them if they've been breached.

By Angela Moscaritolo

This story originally appeared on PCMag

Shutterstock

Everyone knows that creating complex, alphanumeric passwords, let alone remembering them, is pretty much the worst. Our lackluster password skills have spawned an entire password manager business.

Now it seems our troubles were perhaps for naught, and the dude who created the rules about complex passwords would like to apologize.

That man is Bill Burr, who is now 72 and retired. Almost 15 years ago, while working at the National Institute of Standards and Technology (NIST), he wrote what would basically become the bible of password management: NIST Special Publication 800-63. Appendix A. You may have never heard of it, but you're surely familiar with its mandates: passwords must be at least a certain length and include a number, upper and lowercase letters and special characters like an exclamation point or question mark, and must be changed every 90 days.

Now, Burr says that advice was a mistake. "Much of what I did I now regret," Burr tells The Wall Street Journal.

When Burr was writing the publication, he didn't have much data to go by and was being pressured to come up with guidance quickly, according to the Journal. For research purposes, he asked the computer admins at NIST for a peek at the passwords on their network, and they scoffed at the idea. So, to get the job done, he "leaned heavily on a white paper written in the mid-1980s," the Journal reports.

"In the end, it was probably too complicated for a lot of folks to understand very well," Burr says. "It just drives people bananas and they don't pick good passwords no matter what you do."

Fortunately, NIST Special Publication 800-63 recently received a much-needed rewrite. Gone are the rules about changing your password every 90 days and using special characters. NIST now recommends using long passphrases instead of complicated alphanumeric passwords, and only refreshing them if they've been breached.

Angela Moscaritolo has been a PCMag reporter since January 2012. 

Want to be an Entrepreneur Leadership Network contributor? Apply now to join.

Money & Finance

How Much Money Do You Need to Retire Comfortably in Your State? Here's the Breakdown.

Regardless of where you spend your golden years, it pays to be realistic about the cost of living.

Business Ideas

70 Small Business Ideas to Start in 2025

We put together a list of the best, most profitable small business ideas for entrepreneurs to pursue in 2025.

Money & Finance

Turn Simple Ideas Into Never-Ending Paychecks With This Low-Effort Passive Income Strategy

A micro-hustle lets you build once, sell forever and earn money while you sleep.

Buying / Investing in Business

Former Zillow Execs Target $1.3T Market

Co-ownership is creating big opportunities for entrepreneurs.

Leadership

You Can't Build High-Performing Teams by Hiring for Skills Alone. Here's How to Spot the Real Difference-Makers.

Discover why a mindset of ownership is the real differentiator for scaling startups and engineering teams.

Business News

Coinbase CEO Says Company Won't Pay Hackers' Ransom

In a company blog post, Coinbase outlined how it planned to respond to a recent massive breach.