NIST password guidelines

• Password length is more important than password complexity: Contrary to conventional thinking, longer passwords are harder to decrypt than complex ones if stolen. The NIST-recommended password length is a minimum of eight characters.
• Periodic password resets: NIST recommends password resets only when it is suspected that a password has been compromised, so that users do not create passwords that are identical to their old ones, which could happen if prompted to change passwords regularly.
• Cross-verify new passwords with lists of commonly used and compromised passwords: All new passwords must be screened to ensure that they are not commonly used passwords, dictionary words, sequential numbers or letters, or compromised passwords.

• Enable show password while typing: Displaying the password to users while they are typing makes them more likely to type it correctly on the first attempt, thereby eliminating unnecessary account lockouts and password resets.
• Allow the pasting of passwords: Preventing users from pasting text in the password field can slow down account creation and logging in, thus encouraging users to set weak passwords.
• Do not use password hints: Using password hints or asking security questions to help users remember their passwords is strongly not recommended by NIST as they can serve as prompts for even attackers to guess the passwords.
• Limit the number of failed password attempts before account lockout: By limiting the number of failed password attempts, brute-force attacks can be curbed.
• Use multi-factor authentication (MFA): Using other factors of authentication besides passwords can thwart phishing attacks by making the account inaccessible even if the password has been compromised.

• Secure the databases: Access to databases containing users' passwords should be limited to essential personnel only so that hacker activities are restricted.
• Salt and hash passwords: According to NIST standards, passwords should be salted with at least 32 bits of data and hashed with a one-way key derivation function (like PBKDF2 or Balloon).

These settings include mandating the number of special, numeric, and Unicode characters. You can also set the type of character with which the password must begin.

Satisfy the NIST password requirements by configuring the inclusion of alpha-numeric characters in passwords.

These settings help restrict the use of consecutive characters from usernames or previous passwords. Consecutive repetition of the same character can also be restricted.

Restrict users from re-using their previous passwords during password creation.

The settings under this tab help restrict custom dictionary words, patterns, and palindromes that might be commonly used.

Restrict users from using common patterns, dictionary words, and palindromes in their passwords.

These rules let you set both a minimum and maximum number of characters for the password.

Configure the minimum and maximum password length to satisfy the NIST password guidelines.