NIST guidelines discourage password policies that require multiple character sets.

Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets.

It also explains why.

I'm currently lobbying within my company, which is primarily a B2B, to adhere to this guidance but experiencing pushback based on the argumentum ad populum that it is "industry standard".

Just judging from memory I can recall that several websites have required multiple character sets, but right now the only ones I can find are Microsoft and StackOverflow 😂.

What are some major websites that I can cite as examples that adhere to the above NIST guideline of not requiring multiple character sets?

  • Don't forget the other important part of that recommendation - (relatively) long password lengths. Aug 3 '18 at 13:07
  • We haven't, we're going with their recommended minimum of 8 characters.
    – Cory Klein
    Aug 3 '18 at 17:27

These websites don't require multiple character sets in passwords:

Unfortunately, this list is sparse when it comes to B2B websites which may be more convincing to your B2B peers. If any readers are aware of big B2B website password policies, please add them to this list. This answer is a Community Wiki.

When possible I have linked to the password policy. When I can't find an explicit password policy, I personally verified their adherence to NIST by creating an account with the all-lowercase password.

Interestingly, although many sites do not publish their password policy, they almost universally publish password guidance recommending the smart use of multiple character sets, as doing this intelligently is sound password security and in line with NIST guidelines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.