Passwords and passkeys

Where accounts use passwords, Requirements v3.3 asks for two things: protection against password guessing, and a technical control on password quality. For quality you can choose MFA, a minimum length of 12 characters, or a minimum of 8 characters with automatic blocking of common passwords. You should not force regular password changes or complexity rules. Passkeys and FIDO2 authenticators are recognised as passwordless sign-in and count as MFA.

Protection against guessing

Every account must require the user to authenticate. Where that is done with a password, it must be protected against brute-force guessing by at least one of:

• MFA,
• throttling, where the wait between attempts grows after each failure, allowing no more than 10 guesses in 5 minutes, or
• lockout after no more than 10 failed attempts.

Major cloud services apply their own throttling or lockout. On Windows and Active Directory you set an account lockout policy.

Password quality: choose one

You must use a technical control, one the system enforces rather than a written policy alone, to manage password quality. Version 3.3 accepts any one of these:

A deny list is a list of known weak or breached passwords that the system refuses, such as Microsoft Entra Password Protection's banned password list.

Where a password is one factor of MFA, it still needs at least 8 characters with no maximum length.

Device unlock is handled separately under secure configuration: a PIN or password used only to unlock a device must be at least 6 characters. If the same credential also signs in to accounts, these full password rules apply. See secure configuration.

Helping people choose good passwords

Version 3.3 also expects you to support users in picking unique work passwords by:

• explaining what to avoid, such as pet names, keyboard patterns and passwords used elsewhere,
• encouraging longer passwords made of at least three words, in line with the NCSC's three random words advice,
• providing safe storage, such as a password manager, with clear guidance on using it,
• not forcing regular password expiry, and
• not enforcing complexity rules such as "one capital, one number, one symbol".

Expiry and complexity rules push people towards predictable patterns. If your directory still forces a 90-day change, turn it off.

You should also have an established process to change passwords promptly when you know or suspect a password or account has been compromised.

Passwordless and passkeys

Passwordless authentication proves identity with something other than knowledge. Version 3.3 gives examples including:

• passkeys, based on public-key cryptography, including FIDO2 authenticators,
• biometrics, such as fingerprint or face recognition,
• security keys or tokens, such as USB keys or smart cards,
• push notifications to approve a sign-in, and
• one-time codes sent by email, SMS or an app.

FIDO2 authenticators are treated as passkeys, and v3.3 regards them as MFA because the user is verified as part of the sign-in. A passkey on a phone or laptop, or a hardware security key, therefore meets the cloud MFA requirement. See MFA for cloud services.

If an account is fully passwordless, the password length rules do not apply to it, because there is no password. Many services still keep a password as a fallback. If yours does, that password must meet the rules above.

What to do

1. List the sign-in methods each system uses: password only, password plus MFA, or passwordless.
2. Pick a quality option for any password-only accounts, and enforce it in the directory or service settings.
3. Confirm lockout or throttling is in place.
4. Turn off password expiry and complexity rules.
5. Roll out a password manager, and write down how to reset a compromised password quickly.
6. Consider passkeys for cloud services. They remove most password risk and count as MFA.

If you need written policies to go with these settings, see the policy pack.