NIST finalized Special Publication 800-63-4 in July 2025, superseding the 800-63-3 guidelines that shaped a decade of identity programs.1 These are the changes we see having the most impact on enterprise and customer identity designs.
1. Length over complexity
Passwords used as a single factor must be at least 15 characters. Passwords used only as part of multi-factor authentication must be at least 8.3
2. No more composition rules
Verifiers shall not impose other composition rules, such as mandatory mixes of character types.3
3. No forced rotation
Verifiers shall not require subscribers to change passwords periodically. Prospective passwords must be checked against a blocklist of compromised values.3
4. Phishing resistance becomes an expectation
At authenticator assurance level 2, verifiers shall offer at least one phishing-resistant authentication option.3
5. Synced passkeys, wallets and deepfakes
The revision integrates syncable authenticators such as synced passkeys, introduces subscriber-controlled wallets, and adds controls for injection attacks and forged media, including deepfakes, during identity proofing.2
What to do next
Review password policies against these rules, map which applications can offer a phishing-resistant option today, and update identity proofing flows for forged media. For financial-grade APIs, pair this work with FAPI 2.0, which the OpenID Foundation approved as a final specification in February 2025.4
Related insights
Machine identities outnumber people 109 to 1
Service accounts, workloads, API keys and now AI agents vastly outnumber the people in your directory. Most governance programs were built for the minority.
Agentic AI needs an identity strategy before it needs a model strategy
AI agents act on behalf of people and systems. Who they are, what they may touch and how they are audited are identity questions first.
Friction, fraud and the customer at the login screen
Every extra step at sign-in costs conversions. Every missing step invites fraud. The data on where to draw the line.