1. Introduction

Your company’s password policy probably still forces employees to change passwords every 90 days and to combine uppercase, lowercase, numbers and symbols. Those two rules, ubiquitous in corporate environments, have been discredited by the standard that security teams cite as their reference: NIST SP 800-63B. In this article we explain what the standard says, why arbitrary expiry and superficial complexity protect nothing, and how to build a modern business password policy aligned with the guidelines NIST published from 2017 onward and updated in 2024.

The underlying reason is simple: today’s attacker does not “guess” passwords at the keyboard; they buy them, steal them through phishing or crack them with dedicated hardware running billions of attempts per second. Against that arsenal, forcing the employee to add a “!” at the end and change everything every quarter only produces more predictable and more reused passwords.

We cover the five rules of the standard, the correct hashing algorithms for storing credentials, checking against leaked lists, the specific case of Kerberoasting in Active Directory and where the industry is heading with passkeys.

2. Why the Classic Policy Fails

Password cracking numbers explain the obsolescence of the classic policy. A single RTX 4090 graphics card reaches about 165 billion MD5 hashes per second, and about 300 billion in the case of NTLM, the format Active Directory uses to store user passwords. An 8-character alphanumeric password is exhausted within minutes; the RTX 5090, launched in 2026, pushes MD5 speeds to about 240 billion per second. A business password policy for 2026 must therefore start by accepting these numbers.

The example from the book is illustrative: “Madrid2024!”, which meets every imaginable rule (uppercase, lowercase, digits, symbol and local reference), is cracked in seconds. Superficial complexity does not protect, because transformation rules add “2024” and “!” by pure pattern, and cracking starts from dictionaries with billions of entries.

Ninety-day expiry, for its part, produces the opposite of the intended effect: it pushes password reuse across systems, induces trivial variations (“Patata1”, “Patata2”) and increases the employee’s cognitive load, until the password ends up on a post-it note. NIST now acknowledges that forcing periodic rotation without a concrete incident increases the overall weakness.

3. The Rules of NIST SP 800-63B

NIST SP 800-63B (Digital Identity Guidelines) proposes a model that is now the reference criterion for audits and certifications. The comparison with the classic policy summarizes the paradigm shift:

Criterion	Classic policy	NIST SP 800-63B
Main rule	Complexity (uppercase, symbols…)	Length: minimum 8, recommended 12+
Expiry	Forced change every 90 days	No arbitrary expiry
Maximum length	20 characters, no spaces or pasting	Up to 64 characters, passphrases
Checks	No breach screening	Screening against HIBP (>14B leaked)
Storage	Undocumented fast hash	Argon2id or bcrypt cost 12+
Lockout	Hard lock after N attempts	Progressive rate limiting (1-5-15 min)

Fig. 1 – Comparison between the classic password policy and NIST SP 800-63B.

On those five rules a modern business password policy is built: length over complexity, no forced rotation except after an incident or suspicion, no restrictive content rules, screening against leaked passwords at creation and change, and allowing paste from the password manager instead of penalizing it. With long passwords and MFA active on the account, expiry stops being a relevant control.

Privileged accounts deserve their own tier: minimums of 16 characters, manager with tiering and automatic rotation after every use, and breach screening at creation. NIST also recommends verifying the password against leak lists before setting it: most leaked passwords are technically low-entropy, but reused and therefore predictable.

4. Storing Hashes Like a Professional

Policy is only real if credential storage follows the same criterion. Fast hashes (MD5, SHA-1, SHA-256) are unusable for passwords: the asymmetry between attacker and defender cost is completely reversed. The state of the art is purpose-built algorithms with a work factor: Argon2id, winner of the Password Hashing Competition, and bcrypt with a cost equal to or greater than 12, which slows cracking by about six orders of magnitude:

# Cracking speeds with an RTX 4090 (OnlineHashCrack, 2025)
MD5       ~165 billion hashes/s      # unacceptable
NTLM      ~300 billion hashes/s      # unacceptable (legacy AD)
SHA-256   ~22 billion hashes/s       # unacceptable
bcrypt cost 12    ~200,000 hashes/s  # 10^6 times slower
Argon2id          tens of thousands h/s   # state of the art
# Every hash needs a unique salt of at least 16 bytes

Fig. 2 – Cracking speeds by algorithm, with an RTX 4090.

The difference between 165 billion and 200,000 attempts per second is not cosmetic: it is the difference between exhausting a dictionary in seconds and needing centuries. In addition, every password requires a unique salt, and remediation must also cover legacy systems: data protection authorities have already sanctioned organizations for keeping obsolete or unsalted hashes, as a violation of the duty of protection under GDPR.

5. What Is Already Out There: HIBP and Infostealer Logs

Screening against breaches is not optional. Have I Been Pwned (HIBP) centralizes more than 14 billion known passwords and exposes an API with k-anonymity: only the prefix of the password hash is sent and the full list of matches is returned, never revealing the original value. Integrating that check into account creation and password change is the cheapest way to stop an employee from using a combination the attacker already has in their dictionary, and platforms such as Microsoft Entra ID offer their own company-customized banned password lists.

The stolen credential market completes the picture. Beyond the big breaches, infostealer logs (RedLine, Lumma, Vidar, StealC) are sold on underground markets for $5-50 per log, with browser passwords, session cookies and autofill data. Monitoring your own domain’s leaked credentials — via threat intelligence — is the other half of the screening: NIST recommends treating credentials that surface in the wild as compromised, even if your system was never the source.

6. Service Accounts and Kerberoasting

Password policy does not end with users: service accounts are the Achilles heel of Active Directory. Kerberoasting is the preferred weapon against the directory: anyone authenticated in the domain requests service tickets encrypted with the NTLM hash of SPN accounts and cracks them offline with Hashcat in mode 13100. The defense is twofold — gMSA with automatic rotation or service passwords of at least 25 characters — and it is verified with the attacker’s own tool:

# Defensive review of service accounts against Kerberoasting
# 1. Extract tickets from SPN accounts as an attacker would
hashcat -m 13100 tickets.txt rockyou.txt --rules best64.rule
# 2. Audit the real length of service passwords
Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties *
# 3. Migrate to gMSA (managed service accounts) or >= 25 chars
Add-KdsRootKey -EffectiveImmediately
New-ADServiceAccount -Name svc_payments -Enabled $true

Fig. 3 – Defensive check of SPN accounts against Kerberoasting.

The same hierarchy applies to other offline theft routes: AS-REP Roasting (Hashcat mode 18200, avoidable without flagging “do not require pre-authentication”), Pass-the-Hash and Pass-the-Ticket require hardening LSASS (Credential Guard, Restricted Admin Mode) and tiered administration models. If you check the real length of the SPN accounts in your domain, you will almost always find 10-character passwords with years of age: that is the number one target for internal attacks.

7. Password Managers, MFA and the Passkey Horizon

No policy survives contact with reality if the employee has no corporate password manager. NIST explicitly requires allowing paste from the manager and supporting passwords up to 64 characters precisely so that passphrases are viable. Browser password managers are an insufficient convenience: they are the first target of infostealers. A corporate manager (Bitwarden, 1Password, Dashlane, Keeper, even self-hosted) with shared repositories, emergency recovery and an offboarding process plays that role securely.

Hierarchical MFA accompanies the password on every relevant account: SMS only as a last resort, TOTP as an acceptable baseline, push with number matching against MFA fatigue, and FIDO2/WebAuthn (security keys, passkeys, Windows Hello with TPM) as the phishing-resistant factor, the only one that survives AiTM attacks with Evilginx and company, which we cover in depth in our analysis of MITM attacks on credentials.

The medium-term horizon is the structural reduction of the password factor: passkeys replace the shared secret with asymmetric cryptography and local biometrics, making phishing and credential stuffing structurally impossible. Its known objections — account recovery and synchronization across devices — are managed with restoration policies and federated identity providers. When a passkey cannot be stolen or cracked, the password stops being the weakest link of the business password policy.

8. What to Do When a Password Is Compromised

When the compromise of a credential is confirmed, rotation is no longer a formality: change the affected password and any reused ones, revoke sessions and OAuth tokens, analyze the account activity (geographies, schedules, mass downloads, forwarding rules) and hunt for lateral movement; if the account was privileged, the review extends to the whole directory. The complete protocol, including notification deadlines, is described in our article on actions after the hijacking or loss of credentials. The modern approach treats any suspicion with the seriousness of a confirmed breach: a false positive costs little; silent access costs everything.

9. Conclusion

The modern business password policy is not more lenient, it is smarter: length over complexity, no arbitrary expiry, screening against the more than 14 billion leaked passwords, storage with Argon2id or bcrypt cost 12, service accounts immune to offline cracking with gMSA or 25 characters, and a corporate manager with hierarchical MFA.

Removing the 90-day password change is not a relaxation of security: it is the decision that allows concentrating resources where they matter — breach detection, stronger authentication factors and progress toward a passwordless model. The classic policy protected against an attack from 2005; the 2026 policy is built with 2026 data, and that is the best argument for reviewing yours today.

Need help with Business password policy?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.

Contact us for a free infrastructure assessment.