What is the 8 4 rule for passwords?

What is the 8 4 rule for passwords?

The 8-4 rule requires a password of at least 8 characters containing all 4 character types: one uppercase letter, one lowercase letter, one number, and one special character. It was the default corporate password standard for roughly two decades and is still built into many identity providers as a preset. It is a composition rule, meaning it governs what a password contains rather than how hard it is to guess.

The four character types

Type	Example characters
Uppercase	A to Z
Lowercase	a to z
Numeric	0 to 9
Special	! @ # $ % ^ and similar

Why NIST moved away from it

NIST SP 800-63B advises against imposing composition rules. The reasoning is behavioural rather than mathematical: when a rule demands all four types, people satisfy it in the same predictable way. The capital goes first, the number and the exclamation mark go last, and a substitution replaces a letter with a lookalike. Password1! satisfies the 8-4 rule. So does Summer2026!.

Attackers know these patterns and encode them in cracking rules, so the search space is far smaller than the character count implies.

What NIST recommends instead:

• A longer minimum, commonly 8 characters as a floor but with support for much longer passphrases
• Screening against known breached passwords, which removes the credentials attackers actually try first
• No mandatory periodic expiry unless there is evidence of compromise, since forced rotation produces incremental variants
• Allowing all characters including spaces, and not truncating

What SOC 2 and ISO 27001 actually require

Neither prescribes a length or a composition rule.

• SOC 2 CC6.1 requires logical access controls appropriate to your assessed risk. The auditor tests that the settings configured in your identity provider match what your written policy claims.
• ISO 27001 Annex A 5.17 covers authentication information and expects a defined, followed process rather than a specific rule.

The failure mode in an audit is almost never the rule you chose. It is a policy that says one thing while the identity provider is configured to do another, because the policy was written from a template and the setting was left at its default.

A defensible modern policy

1. Minimum 12 characters, no composition requirement
2. Screen new passwords against a breached-password list
3. Enforce MFA, which does more than any password rule on this page
4. No scheduled expiry, with forced reset on suspected compromise
5. Make sure the written policy matches the configured setting, in both directions