No. It is NOT really-really a NIST "standard", as a matter of fact the mentioned NIST documents linked to in the article make a completely different set of sug

No. It is NOT really-really a NIST "standard", as a matter of fact the mentioned NIST documents linked to in the article make a completely different set of suggestions fron what the OP listed: https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html and in any case they are guidelines that only apply to some government infrastructures and actually sport: >These guidelines provide technical requirements for federal agencies implementing digital identity services and are not intended to constrain the development or use of standards outside of this purpose. The relevant section is 5.1.1, apparently the NIST calls passwords "Memorized Secrets" Here is the older version (now superseded by the above): https://csrc.nist.gov/publications/detail/sp/800-63/2/archive/2013-08-29 https://csrc.nist.gov/publications/detail/sp/800-63/2/archiv... https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...