NIST SP 800-63B

Why does it matter?

SP 800-63B-4 is the document an authentication program is measured against, and Revision 4 changes several rules practitioners built policies on. Passwords are now 15 characters minimum when used alone, composition rules and periodic changes are prohibited, and a blocklist check replaces complexity (Section 3.1.1); phishing resistance must be offered at AAL2 and is required at AAL3 (Sections 2.2.2 and 2.3.2); AAL3 asks for a non-exportable key rather than a hardware token by name (Appendix E); and syncable authenticators get their own normative Appendix B. For federal agencies the volume carries SHALL statements, and for everyone else it is the reference that auditors, vendors and identity providers quote.

Key benefits include:

• Password rules with a rationale

Section 3.1.1.2 lists nine verifier requirements, from the 15-character minimum for single-factor use and the blocklist of commonly used, expected or compromised values to the ban on hints, security questions and periodic changes, with Appendix A explaining why.

• Phishing resistance by level

Table 1 summarizes it: not required at AAL1, recommended at AAL2 where a phishing-resistant option SHALL be available, required at AAL3 (Section 3.2.5 defines the property).

• An AAL ladder with timeouts

Each AAL fixes permitted authenticator types, FIPS 140 expectations and reauthentication limits, from a recommended 30-day overall timeout at AAL1 to 12 hours overall and 15 minutes of inactivity at AAL3.

• Rules for the authenticator's life

Section 4 covers binding at enrollment and afterward, subscriber-provided authenticators, renewal, account recovery by IAL and AAL, loss, theft and compromise, expiration, invalidation and account notifications.

• Guidance for passkeys

Appendix B is normative for syncable authenticators: approved cryptography, encrypted storage in the sync fabric, AAL2-equivalent MFA for access to synced keys, and FISMA moderate protections for federal enterprise sync fabrics.

How does it work?

Section 2 sets the requirements per level. AAL1 (2.1) permits a password, look-up secret, out-of-band device, single- or multi-factor OTP, or single- or multi-factor cryptographic authentication; verifiers SHOULD offer multi-factor options; the overall reauthentication timeout SHOULD be no more than 30 days. AAL2 (2.2) requires two distinct factors, either a multi-factor authenticator or a physical authenticator with a password or biometric comparison, at least one replay-resistant authenticator, a phishing-resistant option, and timeouts of 24 hours overall and 1 hour of inactivity. AAL3 (2.3) requires multi-factor cryptographic authentication or single-factor cryptographic authentication plus a password or biometric, a non-exportable private key, phishing and replay resistance, authentication intent, FIPS 140 Level 1 or higher, and timeouts of 12 hours and 15 minutes.

Section 3 then specifies each authenticator type (3.1) and the general requirements (3.2). For passwords, verifiers and CSPs SHALL require at least 15 characters for single-factor use and eight within multi-factor authentication, SHOULD allow at least 64 characters, all printing ASCII, space and Unicode characters, SHALL NOT impose composition rules or periodic changes, SHALL force a change on evidence of compromise, SHALL NOT permit hints accessible to unauthenticated claimants or knowledge-based security questions, SHALL verify the entire password, and SHALL compare new passwords against a blocklist. Section 3.2 adds rate limiting, biometric performance and presentation attack detection, attestation, phishing resistance, verifier communications, replay resistance, authentication intent, restricted authenticators, activation secrets, connected authenticators, random values and exportability.

Sections 4 and 5 cover the authenticator's life and the session. Section 4 requires binding of authenticators at enrollment and post-enrollment, binding of subscriber-provided authenticators, renewal, account recovery methods with requirements by IAL and AAL and recovery notification, handling of loss, theft, damage and compromise, expiration, invalidation and account notifications. Section 5 requires session bindings through browser cookies or access tokens, periodic reauthentication within the Section 2 timeouts and session monitoring. Section 6 lists authenticator threats and mitigations (Tables 3 and 4), Section 7 covers privacy, Section 8 customer experience, and Appendix E logs the changes since the previous edition, such as renaming memorized secrets to passwords and requiring presentation attack detection for facial recognition.

Key Elements

• AAL1 (Section 2.1)

Basic confidence; single- or multi-factor; seven permitted authenticator types; approved cryptography; overall timeout recommended at no more than 30 days, no inactivity timeout required.

• AAL2 (Section 2.2)

High confidence; two distinct factors; at least one replay-resistant authenticator; a phishing-resistant option SHALL be offered; federal staff, contractors and partners SHALL use phishing-resistant authentication; 24-hour overall and 1-hour inactivity timeouts recommended.

• AAL3 (Section 2.3)

Very high confidence; multi-factor cryptographic authentication or single-factor cryptographic plus password or biometric; non-exportable private key; phishing and replay resistance; authentication intent; no syncable authenticators; 12-hour overall limit, 15-minute inactivity recommended.

• General requirements (Section 2.4)

Tailored SP 800-53 moderate baseline or equivalent controls, records retention, privacy requirements including SAOP consultation, SORN and PIA where triggered, and redress mechanisms; Table 1 summarizes requirements by AAL.

• Authenticator types and passwords (Sections 3.1 and 3.1.1)

Passwords, look-up secrets, out-of-band devices, single- and multi-factor OTPs and single- and multi-factor cryptographic authentication, with the nine password verifier rules and the statement that passwords are not phishing-resistant.

• Event and session management (Sections 4 and 5)

Binding, renewal, recovery, loss, theft, compromise, expiration, invalidation and notifications; session bindings, reauthentication and session monitoring.

• Syncable authenticators (Appendix B, normative)

Cloning keys to a sync fabric is allowed under B.2 conditions: approved cryptography, encrypted storage, local private-key operations, access control, AAL2-equivalent MFA to the fabric, documented policy; FISMA moderate fabrics for federal enterprise use.

What does it cover?

Section 1 applies the guideline to the digital authentication of subjects to systems over a network and requires that verifiers and relying parties be authenticated to claimants too; it does not address authentication for physical access, and its protections target credential theft rather than willful sharing of secrets by a subscriber. The abstract scopes it to subjects interacting with government information systems, and the base volume's Section 1.1 adds that private-sector organizations and state, local and tribal governments may consider the standards where appropriate. Section 2 adds one federal floor: because EO 13681 requires multi-factor authentication for the release of personal information, federal agencies SHALL select a minimum of AAL2 when personal information is made available online.

What are its objectives?

The abstract, Section 1 and Section 2 set out what the volume is for:

Define the technical requirements for each of the three authenticator assurance levels so that a claimant is shown to be the subscriber previously authenticated (abstract).

Specify the authenticator types permitted at each AAL and the verifier requirements for them, including approved cryptography and FIPS 140 validation (Sections 2 and 3).

Make phishing-resistant authentication available at AAL2 and mandatory at AAL3 and for federal staff, contractors and partners (Sections 2.2.2 and 2.3.2).

Govern the events in an authenticator's life, from binding and renewal to recovery, loss and invalidation, and the sessions that follow authentication (Sections 4 and 5).

Protect subscriber privacy and provide redress, with the agency Privacy Act and E-Government Act analysis (Sections 2.4.3, 2.4.4 and 7).

Set normative conditions for syncable authenticators while keeping them out of AAL3 (Appendix B, Section 2.3.2).

Framework in Context

SP 800-63B-4 is one of four volumes: the SP 800-63-4 base volume selects the AAL through its risk management process, SP 800-63A-4 covers identity proofing and enrollment, and SP 800-63C-4 covers federation and assertions, where the verifier's result is asserted by an identity provider. Section 2.4.1 ties verifiers to the SP 800-53 moderate baseline or an equivalent federal standard such as FedRAMP or an industry standard, and Section 2.4.3 to the SP 800-53 privacy controls, the Privacy Act of 1974 and the E-Government Act of 2002. FIPS 140 validation through the Cryptographic Module Validation Program applies at every AAL. The previous edition, SP 800-63B of June 2017 as updated March 2, 2020, was superseded on July 31, 2025.

Common Framework Mappings

NIST SP 800-63B is commonly mapped to the access control and authentication requirements of other frameworks, so one authentication standard and its evidence can serve several programs.

Mapped frameworks include:

CIS Controls v8.1

FedRAMP Rev. 5

GDPR

ISO 27001:2022

ISO 27002:2022

ISO 27701

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2