--- question: "What is the 8 4 rule for passwords?" title: "What Is the 8 4 Rule for Passwords" seoTitle: "The 8-4 Password Rule (and Why NIST Dropped It)" summary: "The 8-4 rule requires a password of at least 8 characters containing all 4 character types: uppercase, lowercase, a number, and a special character. It was the default corporate standard for two decades. NIST SP 800-63B now recommends against composition rules of this kind, on evidence that they push people toward predictable substitutions like Password1! while adding little real strength. Length and screening against breached-password lists do more." publishedAt: "2026-08-18" keywords: - "8 4 rule passwords" - "8-4 password rule" - "password complexity requirements" - "NIST password guidelines" - "SOC 2 password policy" - "8 4 password rule" pillar: "SOC 2 Basics for Founders" faqs: - question: "What does the 8 4 password rule mean?" answer: "At least 8 characters, containing all 4 character types: an uppercase letter, a lowercase letter, a number, and a special character. It is a composition rule, meaning it dictates what a password must contain rather than how hard it is to guess." - question: "Is the 8 4 rule still recommended?" answer: "No. NIST SP 800-63B advises against imposing composition rules, because users satisfy them predictably (capital first, number and exclamation mark last) and the resulting passwords are weaker than their apparent complexity suggests. NIST recommends a longer minimum length and screening against known breached passwords instead." - question: "Does SOC 2 require the 8 4 rule?" answer: "No. SOC 2 has no prescribed password length or composition. CC6.1 requires logical access controls appropriate to your risk, and the auditor tests that your configured settings match your written policy. Whatever you choose, the policy and the identity provider configuration have to agree." --- ## What is the 8 4 rule for passwords? The 8-4 rule requires a password of **at least 8 characters containing all 4 character types**: one uppercase letter, one lowercase letter, one number, and one special character. It was the default corporate password standard for roughly two decades and is still built into many identity providers as a preset. It is a composition rule, meaning it governs what a password contains rather than how hard it is to guess. ### The four character types | Type | Example characters | |---|---| | Uppercase | A to Z | | Lowercase | a to z | | Numeric | 0 to 9 | | Special | ! @ # $ % ^ and similar | ## Why NIST moved away from it **NIST SP 800-63B** advises against imposing composition rules. The reasoning is behavioural rather than mathematical: when a rule demands all four types, people satisfy it in the same predictable way. The capital goes first, the number and the exclamation mark go last, and a substitution replaces a letter with a lookalike. `Password1!` satisfies the 8-4 rule. So does `Summer2026!`. Attackers know these patterns and encode them in cracking rules, so the search space is far smaller than the character count implies. What NIST recommends instead: - **A longer minimum**, commonly 8 characters as a floor but with support for much longer passphrases - **Screening against known breached passwords**, which removes the credentials attackers actually try first - **No mandatory periodic expiry** unless there is evidence of compromise, since forced rotation produces incremental variants - **Allowing all characters including spaces**, and not truncating ## What SOC 2 and ISO 27001 actually require Neither prescribes a length or a composition rule. - **SOC 2** CC6.1 requires logical access controls appropriate to your assessed risk. The auditor tests that the settings configured in your identity provider match what your written policy claims. - **ISO 27001** Annex A 5.17 covers authentication information and expects a defined, followed process rather than a specific rule. The failure mode in an audit is almost never the rule you chose. It is a policy that says one thing while the identity provider is configured to do another, because the policy was written from a template and the setting was left at its default. ## A defensible modern policy 1. Minimum 12 characters, no composition requirement 2. Screen new passwords against a breached-password list 3. Enforce MFA, which does more than any password rule on this page 4. No scheduled expiry, with forced reset on suspected compromise 5. Make sure the written policy matches the configured setting, in both directions