I have to write a password specification - for a product and not a web application (if that makes a difference). I could arbitrarily guess at numbers but want to be more scientific. Is there a standard (like an IEC standard), or defined best-practice, for things like minimum length, maximum length, complexity and so on? Ideally a standard I could just point to.


The NIST guidelines contain excellent and modern recommendations. For example, it recommends checking the password against a blacklist instead of enforcing it contains character classes (uppercase, numbers, punctuation characters).

However, it may be that other parties that are specific to your industry enforce other guidelines, for example if you are subject to HIPAA or PCI-DSS.

A more scientific approach would be to calculate the entropy of a password. However, calculating entropy assumes totally random passwords, and users prefer using their cat's name instead of a randomly generated password.

  • Thank you. Very useful. – Richard Mar 29 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.