Its requirements do cover password length, syncable authenticators, email, phone and SMS codes, and session timeouts. The material reviewed for this article does not define what counts as phishing-resistant, so this explainer covers what the guideline text says and labels our own reading wherever it appears.
What the NIST authentication guideline is and who it addresses
The final version of SP 800-63B-4 is dated 07/31/25 in its document history, as listed on the NIST publication page on csrc.nist.gov. When this article quotes a requirement, it identifies who must meet it, because the guideline places its obligations on particular parties.
Many of the requirements apply to verifiers and CSPs, the parties named in the NIST authenticators section on pages.nist.gov. Others apply to federal agencies. For example, the NIST guideline text on pages.nist.gov says federal agencies must select at least AAL2 when personal information is made available online.
Our own reading: these rules are written for the organizations that run sign-in systems, not as instructions to people who hold brokerage, exchange or email accounts. They can still help a reader understand which sign-in options a service offers and why. They do not, by themselves, show how any particular service protects its users.
Password vs MFA: what the text requires of passwords
The clearest password rule in the reviewed claims concerns passwords used on their own. According to the NIST authenticators section on pages.nist.gov, verifiers and CSPs must require passwords used as a single-factor authentication mechanism to be at least 15 characters long.
For historical context, the NIST digital identity FAQ describes the older LOA model. It says that, for authenticators, the biggest difference between LOA1 and LOA2 was that the minimum password size increased from six characters to eight.
| Rule in the reviewed claims | Source |
|---|---|
| Single-factor passwords: at least 15 characters, required by verifiers and CSPs | NIST authenticators section |
| Old LOA model: minimum password size went from six characters to eight between LOA1 and LOA2 | NIST FAQ |
Our own reading: when a password is the only factor, the current text asks for a much longer minimum than the old LOA figures. The reviewed claims set no specific length for passwords used as one factor within MFA, so this article does not give one.
Passkeys, syncable authenticators and AAL3
The reviewed claims never use the word "passkey." They do cover a related category, syncable authenticators. The NIST guideline text on pages.nist.gov says syncable authenticators must not be used at AAL3 because they require the private key to be exportable.
That sentence states both a rule and its stated reason:
- The rule: syncable authenticators are excluded at AAL3.
- The stated reason: they require the private key to be exportable.
What this article cannot settle from the reviewed claims:
- Whether a specific product sold or labeled as a passkey is a syncable authenticator.
- How the guideline treats syncable authenticators at levels other than AAL3.
- Whether any passkey meets a definition of phishing resistance.
Our own reading: anyone comparing a passkey with password MFA should first find out whether the passkey in question syncs its key. That is the property this rule turns on. Because the claims stop there, we leave the classification of specific passkeys unresolved.
Email, SMS and phone codes in multi-factor sign-in
Several common second steps come up in the reviewed claims. The NIST authenticators section on pages.nist.gov says email must not be used for out-of-band authentication. The same section says out-of-band authentication must be considered invalid unless it is completed within 10 minutes.
Phone and SMS codes are covered in the NIST digital identity FAQ. It says authenticators that use the public switched telephone network, including phone- and SMS-based OTPs, are restricted. The reviewed claims do not explain what "restricted" involves in practice, so this article does not describe it further.
| Method | What the reviewed claims say |
|---|---|
| Email for out-of-band authentication | Must not be used |
| Out-of-band authentication in general | Invalid unless completed within 10 minutes |
| Phone- and SMS-based OTPs | Restricted |
Our own reading: "MFA" covers several kinds of second steps, and the guideline treats them differently. A reader looking at the sign-in options on an email, brokerage or exchange account may find this distinction useful, but these rules do not tell you which option a given service uses or how well it works.
Reauthentication timeouts at AAL2 and AAL3
Session rules also differ by level. The NIST guideline text on pages.nist.gov says that at AAL2 a definite overall reauthentication timeout must be set, and it should be no more than 24 hours. At AAL3, the overall reauthentication timeout must be no more than 12 hours.
| Level | Overall reauthentication timeout |
|---|---|
| AAL2 | Must be set; should be no more than 24 hours |
| AAL3 | Must be no more than 12 hours |
Pay attention to the wording. At AAL2 the limit uses "should," while at AAL3 it uses "must." This article keeps that difference instead of presenting both as equally binding.
Our own reading: if a service asks you to sign in again after a period of time, that may reflect a timeout policy of this kind. The claims do not say how any individual service sets its timeouts.
What is phishing-resistant, and how to weigh claims about it
The reviewed claims drawn from the NIST guideline text on pages.nist.gov do not include a definition of phishing resistance. They also do not say whether passkeys, syncable authenticators or any other method meets one. This article leaves that question open on purpose. It does not borrow a definition from secondary summaries that the evidence review did not cover.
That caution applies to security claims in general. The CERT.br quick tips guide says a rumor usually has an alarmist tone, deals with topics currently getting attention, and has no information source or cites unknown sources. A related habit, in our own reading: when a message or post says one sign-in method is safe or unsafe, look for the primary text it relies on, and check whether the original wording says "must," "should" or something weaker.
Here is what this article can and cannot answer about the target question:
- Answered from the claims: rules on single-factor password length, email and out-of-band timing, phone and SMS codes, syncable authenticators at AAL3, and reauthentication timeouts.
- Left open: a definition of phishing resistance, and how specific passkeys fit within it.
Limits of this article
This article is educational information about published authentication guidance. It is not investment advice and does not recommend any product, broker, exchange or service. It does not cover parts of the NIST guideline beyond the claims listed here, and it does not define phishing resistance. It does not assess how any specific account or service protects its users.