What Is the 8-4 Rule for Passwords?
You’ve probably seen the rule a hundred times: the 8-4 rule requires at least eight characters and four character types (uppercase, lowercase, numbers, symbols). That’s the 8-4 rule — and if you’re still treating it as your security target, it’s time for a reality check. The 8-4 rule is outdated; modern guidelines recommend longer passwords or passphrases, and Bill Burr, original author of NIST password complexity rules, apologized in 2017, admitting they decrease security.
Here’s what the rule is, why it’s broken, and what the pros use instead.
Key Takeaways
The 8-4 rule (min 8 characters + 4 character types) was derived from early NIST guidance but is no longer recommended — NIST SP 800-63B (2017) explicitly dropped mandatory complexity and periodic changes.
As of 2023, a modern GPU can crack an 8-character alphanumeric password in a few hours, while a 13-character password takes years and a 16-character passphrase can hold for millions of years.
Only about 8.3% of 34,000 leaked MySpace passwords actually used mixed case, numbers, and symbols — the rule doesn’t work in practice because humans follow predictable patterns.
Table of Contents
What Is the 8-4 Rule for Passwords?
The 8-4 rule is simple: your password needs at least eight characters, and it must contain characters from all four standard types — uppercase, lowercase, a digit, and a symbol. It’s the kind of requirement you see on banking sites, old forum registrations, and that one government portal that still thinks Windows XP is fine.
The idea was reasonable at the time: force enough different characters to make brute-force guessing harder, but as of 2023, a modern GPU can crack an 8-character alphanumeric password in a few hours. Complexity requirements (special characters, numbers, frequent changes) have been debunked as reducing security due to predictable user patterns, and the organizations that created them have moved on.
So if you’ve been dutifully typing variations of “P@ssw0rd!” and feeling smug, stick around — Bill Burr, original author of NIST password complexity rules, apologized in 2017, admitting they decrease security.
Where the 8-4 Rule Came From (and Why Its Creator Apologized)
The 8-4 rule traces back to early NIST password guidelines from the 2000s, written by Bill Burr, one of the authors of NIST SP 800-63. His original document recommended those complexity rules, and because NIST carries weight, the banking industry, IT departments, and every website under the sun adopted it as gospel until NIST SP 800-63B (2017) emphasized length over complexity.
In 2017, Bill Burr publicly apologized to the Wall Street Journal. He told the Wall Street Journal that his advice had made passwords less secure because users followed predictable patterns — add a capital at the start, a number at the end, swap an “o” for a “0”. NIST no longer recommends mandatory complexity requirements; it’s length over complexity now. The complexity requirements didn’t increase entropy; they gave people a formula to follow.
That same year, NIST released SP 800-63B, which reversed course: no more mandatory complexity, no more forced password changes every 90 days, and length over complexity as the new directive.
Google and Facebook removed complexity requirements after discovering they reduced security. Bill Burr, original author of NIST password complexity rules, apologized in 2017, admitting they decrease security.
So the 8-4 rule isn’t just outdated — NIST no longer recommends mandatory complexity requirements; it’s length over complexity.
Why the 8-4 Rule Fails: Short, Predictable, and Fast to Crack
As of 2023, a modern GPU can crack an 8-character alphanumeric password in a few hours. In 2012, a GPU could crack an 8-character alphanumeric password in 9 hours at 7 billion attempts/second. The technique, known as GPGPU password cracking, was pioneered by Elcomsoft, which filed a corresponding US patent in August 2007.
Jump to 13 characters, and as of 2023, a 13-character password can be cracked in a few years. Now consider a 16-character random password — CISA recommends at least 16 characters, and 16-character passwords can take millions of years to crack. Length increases time to crack; the 8-4 rule barely builds a speed bump.
The bigger issue is what humans actually do: human-generated passwords have low entropy (average ~40.54 bits in a study of 500,000 users). When the 8-4 rule is enforced, people don’t create random strings — they create predictable ones, as Bill Burr, original author of NIST password complexity rules, apologized in 2017, admitting they decrease security. A 2006 MySpace phishing attack leaked 34,000 passwords; only 8.3% used mixed case, numbers, and symbols.
Only 8.3% of them actually used a mix of upper case, lower case, numbers, and symbols. The vast majority were trivial variants; weak passwords like ‘123456’, ‘password’, ‘qwerty’ are still commonly used. And that one domain admin password from the DigiNotar breach? “Pr0d@dm1n.” It met the 8-4 rule perfectly, and it was laughably weak — NIST SP 800-63B (2017) emphasizes length over complexity.
Even with key-stretching algorithms like bcrypt or PBKDF2 and random salts, short passwords remain the weak link. Cryptographic salts prevent rainbow table attacks, and key stretching slows down each guess, but eight characters still falls fast when you throw a GPU cluster at it. The real solution is more characters: minimum password length 12-16 characters.
The 8-4 Rule and Mnemonic Passwords: When “Clever” Isn’t Strong
A lot of people use mnemonic passwords — they take a sentence like “I love my dog Spot” and turn it into “Il0v3myD0g$p0t.” Looks random, right? It meets the 8-4 rule, it’s easy to remember, but human-generated passwords have low entropy (average ~40.54 bits in a study of 500,000 users).
Mnemonic passwords have only about 3.7 bits of entropy per character, compared to 6.6 bits for a truly random ASCII printable password; a password with 42 bits of entropy requires 2^42 attempts to brute force. That means the same-length mnemonic password is roughly half as random as it looks; NIST SP 800-63-2 estimated an 8-character human-selected password without uppercase/non-alphabetic characters has 18 bits of entropy. For instance, the PsychoPass method produces passwords like !qAsdE#2, which is a rhomboid shape traced on a US keyboard.
Tools like Dropbox’s zxcvbn are smart enough to model common substitutions — they know that “3” often replaces “E”, that “0” replaces “o”, that “@” replaces “a”. Your clever leet-speak phrase is already in the dictionary. The same goes for keyboard patterns like the PsychoPass method (drawing a shape on the keyboard to pick characters) or the UK government’s old Environ method that suggested patterns like “pinray45”. They all look complex but have lower entropy than their length suggests; NIST SP 800-63-2 estimated an 8-character human-selected password without uppercase/non-alphabetic characters has 18 bits of entropy.
And then there are cultural encoding tricks: the password “ji32k7au4a83” looks like a solid random string — until you learn it’s a common bopomofo keyboard pattern from Chinese input methods. Attackers know these too.
None of this means mnemonic passwords are worthless; passphrases (e.g., 4-7 random words) are recommended for memorability and length. They’re better than “password123”; NCSC 2019 analysis: 23.2 million users used ‘123456’, 7.7 million used ‘123456789’, 3.8 million used ‘qwerty’, 3.6 million used ‘password’, 3.1 million used ‘1111111’. But the 8-4 rule gives users false confidence that their clever phrase is secure when it’s only a small step above the worst habits. If you want a more detailed breakdown of how mnemonic systems work, see our deep dive on mnemonic passwords.
When You’re Stuck with the 8-4 Rule: A Practical Compromise
A 2023 study of 20,000 sites found about 20% still enforce at least two character classes. A 2023 study of 20,000 sites found about 20% still enforce at least two character classes, and some actively limit passwords to 8–12 characters; minimum password length 12-16 characters is recommended. So what do you do when the only option is to follow the rule? Password managers generate, store, and autofill strong passwords.
The straightforward answer: let a password manager generate a random 8-character string that meets the requirements. It won’t be as strong as a 16-character passphrase, but it’ll be better than anything you’d come up with manually. Use that as your minimum baseline for those sites, and then prioritize moving your accounts to services that allow longer passwords. If you have the bandwidth, send a feedback note asking them to update their policy — it’s the only way these legacy rules ever change.
Remember, this is a tactical concession, not an endorsement. Treat the 8-4 rule the way you’d treat a site that still requires Internet Explorer — work around it until you can leave.
Modern Password Best Practices: What to Do Instead
If the 8-4 rule is out, what’s in? NIST recommended minimum password length as of 2026 is 15 characters.
Length over everything. NIST recommended minimum password length as of 2026 is 15 characters. CISA says 16. The Canadian Centre for Cyber Security says 12. October marks Cybersecurity Awareness Month 2024, and a free toolkit is available for download to help improve your security habits.
All of them agree: more characters trumps a mandatory symbol swap. A 16-character all-lowercase passphrase like “HorsePurpleHatRunBay” (four random words, no special characters) has more entropy than “P@ssw0rd!”.
Every account gets its own password. Non-negotiable; every account must have a unique password — no exceptions. Reuse enables credential-stuffing attacks: one breach at a random forum gives attackers the key to your email, bank, and social media. Small changes like adding a number or symbol do not make passwords unique enough.
Use a password manager. This solves the memory problem. Proton Pass, 1Password, and Keeper are well-regarded options that store them with zero-knowledge encryption and autofill them. You only need to recall a single strong master password. Turn on MFA for that master password — it’s the king of the castle.
Add multi-factor authentication wherever possible. MFA is your safety net: even if a password gets stolen, the attacker still needs the second factor. For most accounts, a code from an authenticator app is fine. Passkeys are emerging as an even better option — they use device biometrics and are phishing-resistant, but they’re not universal yet.
Start small. Pick a password manager, update your email and banking first, then work through the rest a few at a time. It doesn’t have to happen in one sitting.
The Human Problem: Why We All Fall Back on Weak Habits
The average person has over 100 online accounts; no human can memorize 100 unique, strong passwords. No human can memorize 100 unique, strong passwords. Security expert Bruce Schneier argues that writing down passwords is acceptable if stored securely, such as in a wallet.
Take Ted — he tried to memorize everything. It worked for a while, but over time he started hesitating at login screens, guessing which variation he’d used for that site, and getting locked out. His memory became a system of patterns and approximations. That’s not security; that’s guesswork.
Then there’s Emma. She reused her password across her bank and email. One breach later, an attacker cleaned out $700 from her checking account and spent hours dealing with the fallout. That’s when she switched to a password manager.
The problem isn’t that people are lazy — it’s that the system expects superhuman memory. That’s why password reuse is so common, and why credential-stuffing attacks are so effective. Even security questions like “What’s your first pet’s name?” are trivially guessable or findable on social media. The human brain wasn’t designed to hold 100 random strings, and pretending otherwise leads to the same old weak habits: “123456”, “password”, “qwerty”. NCSC 2019 analysis: 23.2 million users used ‘123456’, 7.7 million used ‘123456789’, 3.8 million used ‘qwerty’, 3.6 million used ‘password’, 3.1 million used ‘1111111’.
This is why password managers aren’t a crutch — they’re a necessity. For more on memory-friendly systems, check out how to memorize passwords using spaced repetition and our guide to good passwords that are easy to remember.
The Bottom Line: Move Beyond the 8-4 Rule
So is the 8-4 rule still recommended? Short answer: no. No major cybersecurity authority — NIST, CISA, NCSC, endorses it today. It was a step forward from the stone ages of six-character passwords, but it’s no longer a destination.
The most impactful single step you can take: adopt a password manager and start using long, unique, random passwords for every account. Start with your most critical logins — email and banking, and work your way through the rest. Enable MFA where you can. That’s it. You’re already ahead of the 8-4 rule and everyone still living in 2005.
People Also Ask
What is the 8 4 password rule?
The 8-4 rule requires a password to be at least eight characters long and include all four character types: uppercase, lowercase, a digit, and a symbol. It was derived from early NIST guidance but is now considered outdated — modern standards prioritize length over complexity.
What is the 3 word password rule?
The three-word rule is a modern alternative to the 8-4 rule that suggests using three random words as a passphrase (e.g., ‘HorsePurpleHatRun’). This approach creates longer passwords that are easier to remember and far more resistant to brute-force attacks than short, complex strings.
What is the most hacked password?
The most commonly hacked passwords are predictable patterns like ‘123456’, ‘password’, and ‘qwerty’. A 2019 NCSC analysis found 23.2 million users had used ‘123456’ alone — these weak passwords are still widely used despite decades of security warnings.
Why did the creator of the 8-4 rule apologize?
Bill Burr, the original author of NIST’s password complexity guidelines, publicly apologized in 2017, admitting his advice made passwords less secure. Users followed predictable patterns — capital at the start, number at the end, symbol substitutions — which reduced actual entropy and made passwords easier to guess.
How long should a password be instead of 8 characters?
Modern cybersecurity authorities recommend passwords of at least 12–16 characters. NIST’s recommended minimum as of 2026 is 15 characters, and CISA recommends 16. A 16-character passphrase can take millions of years to crack, while an 8-character one falls in hours.
