If you’ve searched for SPSB 63, you’ve likely encountered a garbled reference to NIST SP 800-63 — the U.S. National Institute of Standards and Technology’s Digital Identity Guidelines. This is the real standard that governs how digital identity is verified, how authentication works, and how organizations manage the lifecycle of digital credentials. (Obscure, jumbled search terms like this are more common than you’d think — see our look at Hochre for another example.) This guide explains what SP 800-63 is, its core components, the major 2025 revision, and why it matters.
What Is NIST SP 800-63?
NIST Special Publication 800-63 is a set of guidelines published by the U.S. National Institute of Standards and Technology. It provides a framework for digital identity — covering how identities are proofed (verified), how users authenticate, and how i If you arrived here by searching ‘SPSB 63’, you’re in the right place — that’s simply a transposed spelling of the standard’s real name.dentity information is federated (shared) across systems. The current edition, Revision 4, was finalized in July 2025 and is published at pages.nist.gov/800-63-4.
The guidelines are used by U.S. federal agencies and widely adopted by private-sector organizations worldwide as a best-practice framework for identity and access management.
Revision 4: The 2025 Update
In July 2025, NIST released the final version of SP 800-63, Revision 4 — the first major update since the 2017 edition. Developed over nearly four years with public drafts and industry feedback, Revision 4 responds to how much the digital landscape has changed: phishing is more sophisticated, AI-generated deepfakes can spoof identity checks, and passkeys have gone mainstream. The most important changes include:
- Longer passwords, no forced rotation: Memorized secrets must now be at least 15 characters, while the old practice of forcing password changes every 90 days is gone — NIST found forced rotation pushed people toward weaker, predictable passwords.
- Passkeys and syncable authenticators: Revision 4 formally embraces syncable authenticators — the technology behind passkeys — reflecting how authentication has moved beyond passwords.
- Deepfake and injection defenses: New controls address AI-generated deepfakes and injection attacks against identity proofing, a threat that barely existed when the previous revision was written.
- Stronger phishing resistance: Expanded emphasis on phishing-resistant authentication methods, such as FIDO2 security keys, for higher assurance levels.
- Equity and usability: New requirements to evaluate the demographic impact of identity systems, so proofing processes don’t unfairly exclude people based on race, age, or disability.
The Three Core Components
SP 800-63 is organized into three main parts, each addressing a different aspect of digital identity:
IAL: Identity Assurance Levels
IAL measures how confident we are that a person is who they claim to be. It has three levels:
- IAL1: Self-asserted identity (e.g., creating an account with an email address). No verification required.
- IAL2: Remote or in-person identity proofing using documents (e.g., verifying a driver’s license for a bank account).
- IAL3: In-person verification with biometric collection (e.g., for high-security government credentials).
AAL: Authenticator Assurance Levels
AAL measures how confident we are that the person presenting a credential is the legitimate holder:
- AAL1: Single-factor authentication (e.g., password only).
- AAL2: Multi-factor authentication (e.g., password plus a one-time code or authenticator app).
- AAL3: Hardware-based cryptographic authenticator (e.g., FIDO2 security key) with phishing resistance.
FAL: Federation Assurance Levels
FAL measures the strength of identity federation — when one system trusts another’s authentication (e.g., “Sign in with Google”):
- FAL1: Basic signed assertion.
- FAL2: Encrypted assertion.
- FAL3: Encrypted assertion with holder-of-key proof.
Why SP 800-63 Matters
This standard shapes how digital identity works across the internet:
- For users: It drives the shift toward phishing-resistant authentication (like passkeys) and away from passwords alone — and Revision 4’s longer-password, no-forced-rotation rules directly affect the login screens you use every day.
- For businesses: It provides a clear framework for choosing appropriate identity verification based on risk — no more one-size-fits-all. A streaming service and a bank shouldn’t proof identities the same way, and the IAL/AAL levels say exactly how they should differ.
- For developers: It defines technical requirements for authenticators, federation protocols, and lifecycle management — the concrete specs behind the login flows you build.
- For policymakers: It balances security, privacy, and usability in digital services, and Revision 4 adds explicit equity considerations so identity systems work for everyone.
For more on how digital identity works in practice, see our guide to digital identity.
Key Concepts Explained
A few terms from the guidelines worth knowing:
- Authenticator: Something you use to prove identity — a password, phone, security key, or biometric.
- Identity proofing: The process of verifying that a person is who they claim to be (e.g., checking ID documents).
- Federation: When you use one account (like Google) to sign into other services — the identity provider vouches for you.
- Memorized secret: The guidelines’ term for passwords — which they recommend phasing out in favor of stronger methods.
- Syncable authenticator: A credential (like a passkey) that can be securely synced across a user’s devices — formally recognized in Revision 4.
Frequently Asked Questions
What is SPSB 63?
SPSB 63 appears to be a garbled reference to NIST SP 800-63, the U.S. Digital Identity Guidelines. SP 800-63 is the real standard covering identity proofing, authentication, and federation.
What does NIST SP 800-63 cover?
It covers three areas: Identity Assurance Levels (IAL) for verifying who someone is, Authenticator Assurance Levels (AAL) for how they prove it, and Federation Assurance Levels (FAL) for sharing identity across systems.
What changed in Revision 4 (2025)?
Revision 4, finalized in July 2025, requires passwords of at least 15 characters with no forced rotation, formally embraces passkeys and syncable authenticators, adds defenses against deepfakes and injection attacks, strengthens phishing resistance, and introduces equity evaluations for identity systems.
What is the difference between IAL2 and IAL3?
IAL2 involves remote or in-person identity proofing using documents (like a driver’s license). IAL3 requires in-person verification with biometric collection, reserved for the highest-security scenarios.
Does SP 800-63 require multi-factor authentication?
For higher assurance levels, yes. AAL2 requires multi-factor authentication (e.g., password plus authenticator app), and AAL3 requires phishing-resistant hardware authenticators like FIDO2 security keys.
Is SP 800-63 mandatory?
It is mandatory for U.S. federal agencies. Private-sector organizations adopt it voluntarily as a best-practice framework for identity and access management.
Does NIST still recommend changing passwords regularly?
No. Revision 4 dropped forced periodic password rotation, because research showed it pushed people toward weaker, predictable passwords. Instead, passwords must be at least 15 characters, and the emphasis is on length and phishing-resistant methods like passkeys.
The Bottom Line
SPSB 63, properly understood as NIST SP 800-63, is one of the most important — and least understood — standards shaping digital life. Every time you use multi-factor authentication, verify your identity for a bank account, or sign in with a federated provider, you’re benefiting from the framework it defines. And with Revision 4 (2025) pushing passkeys, longer passwords, and deepfake defenses, its influence is only growing. Understanding IAL, AAL, and FAL isn’t just for security professionals; it’s for anyone who wants to understand how trust works online.
