NIST SP 800-63B-4 (2025) requires passwords used as a single factor to be at least 15 characters (at least 8 when used only within multi-factor authentication), to allow at least 64 characters and all printable characters including spaces and Unicode, and to be checked against blocklists of common and breached passwords. It forbids composition rules and periodic forced changes; a change is required only on evidence of compromise. Password managers and paste must be allowed.
Servers must store salted, slow hashes (Argon2id, scrypt, bcrypt or PBKDF2) and rate-limit guessing. None of that stops phishing or credential stuffing with reused passwords, which is why passkeys are the recommended replacement, starting as an optional second method and moving to password-free accounts.