The Nevada System of Higher Education follows the National Institute of Standards and Technology (NIST) cyber security framework to increase information security across the system. The updated UNLV password guidelines improve security and bring the standards more in line with NIST recommendations.

Password Criteria

1. Here’s a clear, paraphrased version of those rules:
2. Passwords must contain at least 12 characters.
3. You may use any keyboard character, including spaces, if supported.
4. Avoid repeating characters or predictable sequences (e.g., aaaa, 1234, qwerty, 1qaz2wsx).
5. Do not rely on dictionary words with simple substitutions (e.g., PA$$word, PA55word).
6. Never reuse or copy example passwords from these guidelines (or from any other source).

Passphrases

• Strong passwords balance security with memorability.
• Passphrases are long strings that are easy to recall but difficult for attackers to guess.

Ways to create a passphrase:

• Combine several random words with spaces. Use at least six unrelated words.
  Example: correct horse battery staple apple reader
• Turn a sentence or phrase you remember into a passphrase by using phonetics, symbols, or substitutions.
  Example Sentence: I love horses, they are great!
  Passphrase: 1<3horses,thArGr8!
• Take the first letter of each word from a long, memorable sentence (include punctuation).
  Example Sentence: My neighbor mows the lawn every Saturday except in winter or when it’s raining.
  Passphrase: MnmtleSeiwowir.

Password Expiration
Passwords will not expire at regular intervals. Password change will only be required if a breach of the account or a compromise of the password is suspected.

Password Reuse
Do not use the same password for two different services (e.g., websites, computing devices, mobile apps). Additionally, when changing a password, do not use a password that you have previously used.

Password Managers
Password managers allow you to easily store and recall passwords for all your accounts and secure them with a master password. Users are encouraged to review the features of a password manager and ensure that it meets their personal requirements and is compatible with the platforms on which they plan to use it.

Some general recommendations when using any password manager:

Password managers usually include a browser plugin that will allow you to autofill passwords on websites or autosave passwords as you input them. If these plugins are used, they should be configured to auto-logout after a period of time so that you will need to enter your master password again. They should not be left unlocked indefinitely.

Ensure that you select a very secure master password. If this password is compromised, an attacker could have access to all your other passwords. Use the passphrases guidelines above to create a passphrase that is secure and yet memorable.