Passwords, the way the guidance actually reads
7 scenes, about 1.9 minThe rules changed
Most password advice you have heard is older than the guidance it came from. The current federal guidance says something simpler, and it asks less of you than the old rules did.
Visual: An old password rule card on the left fading out, a shorter new card sliding in on the right.
8 minimum, 64 allowed
Length is what matters. A password you choose yourself has to be at least eight characters, and the system has to accept one up to at least sixty four, which is room for a whole phrase.
Visual: A single bar growing from eight blocks to sixty four, with a phrase written along it.
Spaces and symbols are fine
Spaces count. So does every printable character, and so does emoji. Nothing you can type is off limits, which means a phrase you can actually remember is a valid password.
Visual: A keyboard diagram with every key lit, and a four word phrase typed underneath it.
No forced character mix
There is no rule saying you must mix upper case, digits and symbols. Those composition rules push people toward predictable patterns, so the guidance drops them.
Visual: A checklist of composition rules with a line drawn through the whole list.
Change it on evidence, not schedule
You are not asked to change your password every ninety days either. Rotation happens when there is evidence the password has been exposed, and not on a calendar.
Visual: A calendar with the ninety day marker crossed out, next to an alert icon that is lit.
Checked against breach lists
What is checked instead is whether the password already appears in a breach list or a dictionary. If it does, you get asked to pick another one, and that is the check doing its job.
Visual: A password moving through a filter labelled breached and common, one path blocked, one clear.
Paste allowed, hints gone
Two more things the guidance allows on purpose. You can paste into a password field, so a password manager works. And nobody should be asking you for a password hint or your mother's maiden name.
Visual: Two tiles: a paste action succeeding, and a security question form marked as retired.
Knowledge check
What is the shortest password the guidance allows you to choose?
Eight characters, and the system has to accept up to at least sixty four.
When should a password be changed?
When there is evidence it has been exposed, not on a fixed schedule.
Why are breach list checks used instead of composition rules?
Because a password already known to attackers is the real risk, while forced character mixes push people toward predictable patterns.