What is the minimum password length for a payment platform?

PCI DSS v4.0.1 sets a minimum of 12 characters for passwords that give access to system components. NIST SP 800-63B Revision 4 asks for at least 15 characters when a password is the only authenticator and support for at least 64 characters, so long passphrases satisfy both.

Two references

PCI DSS v4.0.1 requires a minimum of 12 characters, or 8 where the system does not support 12, with a mix of letters and numbers, for passwords that give access to system components in the cardholder data environment. NIST SP 800-63B Revision 4 asks for at least 15 characters when a password is the only authenticator, and for systems to accept at least 64 characters so users can choose long passphrases.

A policy that satisfies both

• Minimum 15 characters for every console account.
• Maximum length of at least 64, with spaces and all printable characters allowed.
• No forced composition rules beyond that, since they push users toward predictable substitutions.
• Screening against breached-password lists at creation and change.
• Multi-factor authentication on top, which is what actually protects the account.

What to document

The policy, the technical enforcement in the console, and the mapping to each requirement. Assessors look for evidence that the configured minimum matches the written policy. Operators offering a white-label console to merchants should apply the same rules to merchant users, since a merchant account with a weak password is an entry point into the operator's platform.