That's a minimum maximum requirement. It says that the password must be allowed ...

kibwen on Nov 23, 2016 | parent | context | favorite | on: NIST’s new password rules – what you need to know

That's a minimum maximum requirement. It says that the password must be allowed to be at least 64 characters long, not that they be at most 64 characters long. Combined with the forbidding of composition rules and the demand that all ASCII and Unicode be allowed, 64 characters is more than enough.