Business cybersecurity News security technology

NIST Says that Complex and Complicated Passwords Are More Unsafe Than Long Passwords that Are Simple

Arooj Ahmed8 hours ago

0 0 1 minute read

According to the new guidelines published by the US National Institute of Standards and Technology (NIST), using smaller/complicated passwords or changing your passwords frequently doesn’t mean that your accounts are safe. For years, experts have recommended creating passwords with complex characters including lower case letters, upper case letters, symbols and numbers. This practice was deemed as appropriate to keep your passwords safe. But now it has been revealed that this isn’t the case.

Many people create complex passwords but this complexity of passwords makes people use the same password for multiple accounts. NIST found that this is actually one of the reasons for weakened security. NIST suggests that the practice of using complex passwords should be stopped and people should be encouraged to have longer passwords instead.

Many studies suggest that users cannot remember complex passwords so they use the same password everywhere. Many organizations were also asking their employees to change their passwords every 60 to 90 days, which NIST now deemed unsuitable. The combination of multiple characters in a password is a good thing but NIST suggests that passwords should be longer. A longer password will have more complex combinations which would make it hard to crack the password. Simple but long phrases without the space can also be used as a strong yet user-friendly password.

Recently, Mayor Eric Adams, the mayor of New York City, said that he’s changing the passcode on his personal phone from four-digit to six-digit. This changed the possible password combinations from 10,000 to 1000,000. NIST suggests that people should be allowed to create passwords of 64 characters. A 64 characters password with only lower case letters and simple words is really hard to crack. Add a mix of capital letters and symbols in the 64 characters password, and it is mathematically impossible to crack.