3 tips from NIST to keep your passwords secure

At the same time, we routinely hear about data breaches, and unfortunately they show few signs of slowing down.

So, how do you know if your password is secure?

In NIST Special Publication 800-63B - Digital Identity Guidelines - Authentication and Lifecycle Management, we see a set of informative recommendations on password security.

‘Appendix A - Strength of Memorized Secrets’ provides three simple recommendations, applying them also to PINs and passphrases.

If the password is too short, it can be susceptible to a brute force attack, where a computer, or malicious computer program, goes through every combination of characters of 8 digits, or more. The program may also go through the most common passwords, guessing in a handful of tries.

According to NIST, “users should be encouraged to make their passwords as lengthy as they want, within reason.”

At just 14 characters, random strings are extremely secure.

A passphrase uses random words together as a password. Some people prefer passphrases because with just a few words they provide both strong security and the potential to be remembered or entered manually if needed.

So while password complexity is often imposed by websites, it is incomplete until we remove the human element in creating a complex password. Security-conscious sites might offer a recommended random password. And while likely safe, many users would rightfully prefer to create their own password.

Of course, complex passwords are hard to remember, and we will address this shortly.

According to NIST, “secrets that are randomly chosen…will be more difficult to guess or brute-force attack than user-chosen secrets meeting the same length and complexity requirements.”

Passwords, still ubiquitous across websites and applications, deliver a powerful first line of defense for internet users. This is especially true when users create long, complex, and random passwords for each website.

All of these best practices make it impossible to manage as a human being, but very easy to manage for a computer and computer program.

• 14 characters long or more
• Complex
• Random

Clearly there is no way to do this, except for with the help of a password manager.

A password manager lets you create one primary password (recommended to be long, complex, and random) and then use that to encrypt and store your other passwords. You can start with just a few, and add more passwords to your password manager over time.

Password managers also come with password generators so you can create long, complex, and random passwords with the click of a button.

How does the password manager keep your passwords safe? Most start by ensuring that they do not store your passwords, but only encrypted versions that can only be decrypted by the user themselves. The password manager provider, by storing your information with end-to-end encryption, does not know your secure information and cannot derive it in any way, even if the company tried.

For more on security in password managers, see our help section on security.

With a password manager in place, users can create unique passwords for every website that are long, complex, and random. They can also synchronize passwords across multiple devices and if desired, share information securely with family, friends or colleagues.

If you are using another password manager, you can import that data into Bitwarden.