{
  "release_id": "password-statistics-release-1-v1",
  "generated_at": "2026-10-21T16:00:00Z",
  "last_verified_at": "2026-10-21",
  "calculation_version": "1.0.0",
  "finding_scope": "Computed models and a complete EFF word-length census; no observed attacks or user data.",
  "model_inputs": {
    "release_id": "password-statistics-release-1-v1",
    "published_date": "2026-10-21",
    "generated_at": "2026-10-21T16:00:00Z",
    "calculation_version": "1.0.0",
    "seconds_per_year": "31557600",
    "alphabets": [
      {
        "id": "lowercase",
        "name": "Lowercase letters",
        "size": 26
      },
      {
        "id": "alphanumeric",
        "name": "Uppercase, lowercase, and digits",
        "size": 62
      },
      {
        "id": "printable-ascii",
        "name": "Printable ASCII characters",
        "size": 94
      }
    ],
    "password_lengths": [
      8,
      12,
      16,
      20,
      24
    ],
    "attack_rates": [
      {
        "id": "online-model",
        "name": "Rate-limited model",
        "guesses_per_second": "100",
        "scope": "Mathematical input illustrating an online service with throttling; not a measured service rate."
      },
      {
        "id": "offline-billion-model",
        "name": "Offline 1 billion/s model",
        "guesses_per_second": "1000000000",
        "scope": "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      },
      {
        "id": "offline-trillion-model",
        "name": "Offline 1 trillion/s model",
        "guesses_per_second": "1000000000000",
        "scope": "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      }
    ],
    "entropy_targets": [
      40,
      60,
      80,
      100,
      128
    ],
    "passphrase_word_counts": [
      4,
      5,
      6,
      8
    ]
  },
  "sources": [
    {
      "id": "eff-long-wordlist-2016-07-18",
      "title": "EFF Long Wordlist for Passphrases",
      "source_url": "https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt",
      "local_path": "assets/eff_large_wordlist.txt",
      "expected_entries": 7776,
      "expected_unique_words": 7776,
      "sha256": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "retrieved_date": "2026-09-23",
      "rights_note": "Reuse the repository's existing source file and preserve its EFF attribution. Confirm redistribution terms before replacing or expanding the source material.",
      "verified_sha256": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e"
    },
    {
      "id": "nist-sp-800-63b-4",
      "title": "NIST Special Publication 800-63B-4: Authentication and Authenticator Management",
      "source_url": "https://pages.nist.gov/800-63-4/sp800-63b.html",
      "publication_date": "2025-08-26",
      "reviewed_date": "2026-10-21",
      "relevant_sections": [
        "Section 3.2.2 — Rate Limiting (Throttling)",
        "Appendix A — Strength of Passwords",
        "Appendix D — Definitions of offline and online attacks"
      ],
      "evidence_role": "Supports the distinction between online and offline guessing, the role of throttling and password storage, and the warning that user-chosen password entropy is difficult to estimate. It does not supply this release's assumed guessing rates."
    }
  ],
  "statistics": [
    {
      "id": "space-lowercase-8",
      "title": "8-character lowercase letters search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "208827064576",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "208,827,064,576",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 26^8.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-lowercase-8",
      "title": "8-character lowercase letters modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "37.603518",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "37.60 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "8 × log2(26), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-8-online-model",
      "title": "8-character lowercase letters exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "52206766144",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "66.17 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-8-online-model",
      "title": "8-character lowercase letters expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "208827064577",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "33.09 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-8-offline-billion-model",
      "title": "8-character lowercase letters exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "815730721",
        "denominator": "3906250",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.48 minutes",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-8-offline-billion-model",
      "title": "8-character lowercase letters expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "208827064577",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.74 minutes",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-8-offline-trillion-model",
      "title": "8-character lowercase letters exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "815730721",
        "denominator": "3906250000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "0.209 seconds",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-8-offline-trillion-model",
      "title": "8-character lowercase letters expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "208827064577",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "0.104 seconds",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-lowercase-12",
      "title": "12-character lowercase letters search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "95428956661682176",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "95,428,956,661,682,176",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 26^12.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-lowercase-12",
      "title": "12-character lowercase letters modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "56.405277",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "56.41 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "12 × log2(26), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-12-online-model",
      "title": "12-character lowercase letters exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "23857239165420544",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.02e7 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-12-online-model",
      "title": "12-character lowercase letters expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "95428956661682177",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.51e7 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-12-offline-billion-model",
      "title": "12-character lowercase letters exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "186384680979848",
        "denominator": "1953125",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.02 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-12-offline-billion-model",
      "title": "12-character lowercase letters expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "95428956661682177",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.51 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-12-offline-trillion-model",
      "title": "12-character lowercase letters exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "23298085122481",
        "denominator": "244140625",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.1 days",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-12-offline-trillion-model",
      "title": "12-character lowercase letters expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "95428956661682177",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "13.25 hours",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-lowercase-16",
      "title": "16-character lowercase letters search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "43608742899428874059776",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "43,608,742,899,428,874,059,776",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 26^16.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-lowercase-16",
      "title": "16-character lowercase letters modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "75.207035",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "75.21 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "16 × log2(26), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-16-online-model",
      "title": "16-character lowercase letters exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "10902185724857218514944",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.38e13 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-16-online-model",
      "title": "16-character lowercase letters expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "43608742899428874059777",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "6.91e12 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-16-offline-billion-model",
      "title": "16-character lowercase letters exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "85173325975447019648",
        "denominator": "1953125",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.38e6 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-16-offline-billion-model",
      "title": "16-character lowercase letters expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "43608742899428874059777",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "690,938.84 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-16-offline-trillion-model",
      "title": "16-character lowercase letters exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "10646665746930877456",
        "denominator": "244140625",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1,381.88 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-16-offline-trillion-model",
      "title": "16-character lowercase letters expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "43608742899428874059777",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "690.94 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-lowercase-20",
      "title": "20-character lowercase letters search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "19928148895209409152340197376",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "19,928,148,895,209,409,152,340,197,376",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 26^20.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-lowercase-20",
      "title": "20-character lowercase letters modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "94.008794",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "94.01 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "20 × log2(26), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-20-online-model",
      "title": "20-character lowercase letters exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "4982037223802352288085049344",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "6.31e18 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-20-online-model",
      "title": "20-character lowercase letters expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "19928148895209409152340197377",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.16e18 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-20-offline-billion-model",
      "title": "20-character lowercase letters exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "38922165810955877250664448",
        "denominator": "1953125",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "6.31e11 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-20-offline-billion-model",
      "title": "20-character lowercase letters expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "19928148895209409152340197377",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.16e11 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-20-offline-trillion-model",
      "title": "20-character lowercase letters exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "4865270726369484656333056",
        "denominator": "244140625",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "6.31e8 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-20-offline-trillion-model",
      "title": "20-character lowercase letters expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "19928148895209409152340197377",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.16e8 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-lowercase-24",
      "title": "24-character lowercase letters search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "9106685769537214956799814036094976",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "9,106,685,769,537,214,956,799,814,036,094,976",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 26^24.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-lowercase-24",
      "title": "24-character lowercase letters modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "112.810553",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "112.81 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "24 × log2(26), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-24-online-model",
      "title": "24-character lowercase letters exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "2276671442384303739199953509023744",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "2.89e24 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-24-online-model",
      "title": "24-character lowercase letters expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "9106685769537214956799814036094977",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.44e24 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-24-offline-billion-model",
      "title": "24-character lowercase letters exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "17786495643627372962499636789248",
        "denominator": "1953125",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "2.89e17 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-24-offline-billion-model",
      "title": "24-character lowercase letters expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "9106685769537214956799814036094977",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.44e17 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-lowercase-24-offline-trillion-model",
      "title": "24-character lowercase letters exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "2223311955453421620312454598656",
        "denominator": "244140625",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "2.89e14 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-lowercase-24-offline-trillion-model",
      "title": "24-character lowercase letters expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "9106685769537214956799814036094977",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.44e14 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-alphanumeric-8",
      "title": "8-character uppercase, lowercase, and digits search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "218340105584896",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "218,340,105,584,896",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 62^8.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-alphanumeric-8",
      "title": "8-character uppercase, lowercase, and digits modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "47.633570",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "47.63 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "8 × log2(62), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-8-online-model",
      "title": "8-character uppercase, lowercase, and digits exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "54585026396224",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "69,187.8 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-8-online-model",
      "title": "8-character uppercase, lowercase, and digits expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "218340105584897",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "34,593.9 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-8-offline-billion-model",
      "title": "8-character uppercase, lowercase, and digits exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "852891037441",
        "denominator": "3906250",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "2.53 days",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-8-offline-billion-model",
      "title": "8-character uppercase, lowercase, and digits expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "218340105584897",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.26 days",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-8-offline-trillion-model",
      "title": "8-character uppercase, lowercase, and digits exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "852891037441",
        "denominator": "3906250000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.64 minutes",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-8-offline-trillion-model",
      "title": "8-character uppercase, lowercase, and digits expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "218340105584897",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.82 minutes",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-alphanumeric-12",
      "title": "12-character uppercase, lowercase, and digits search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "3226266762397899821056",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "3,226,266,762,397,899,821,056",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 62^12.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-alphanumeric-12",
      "title": "12-character uppercase, lowercase, and digits modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "71.450356",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "71.45 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "12 × log2(62), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-12-online-model",
      "title": "12-character uppercase, lowercase, and digits exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "806566690599474955264",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.02e12 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-12-online-model",
      "title": "12-character uppercase, lowercase, and digits expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "3226266762397899821057",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "5.11e11 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-12-offline-billion-model",
      "title": "12-character uppercase, lowercase, and digits exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "6301302270308398088",
        "denominator": "1953125",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "102,234.22 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-12-offline-billion-model",
      "title": "12-character uppercase, lowercase, and digits expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "3226266762397899821057",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "51,117.11 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-12-offline-trillion-model",
      "title": "12-character uppercase, lowercase, and digits exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "787662783788549761",
        "denominator": "244140625",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "102.23 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-12-offline-trillion-model",
      "title": "12-character uppercase, lowercase, and digits expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "3226266762397899821057",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "51.12 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-alphanumeric-16",
      "title": "16-character uppercase, lowercase, and digits search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "47672401706823533450263330816",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "47,672,401,706,823,533,450,263,330,816",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 62^16.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-alphanumeric-16",
      "title": "16-character uppercase, lowercase, and digits modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "95.267141",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "95.27 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "16 × log2(62), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-16-online-model",
      "title": "16-character uppercase, lowercase, and digits exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "11918100426705883362565832704",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.51e19 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-16-online-model",
      "title": "16-character uppercase, lowercase, and digits expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "47672401706823533450263330817",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "7.55e18 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-16-offline-billion-model",
      "title": "16-character uppercase, lowercase, and digits exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "93110159583639713770045568",
        "denominator": "1953125",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.51e12 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-16-offline-billion-model",
      "title": "16-character uppercase, lowercase, and digits expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "47672401706823533450263330817",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "7.55e11 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-16-offline-trillion-model",
      "title": "16-character uppercase, lowercase, and digits exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "11638769947954964221255696",
        "denominator": "244140625",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.51e9 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-16-offline-trillion-model",
      "title": "16-character uppercase, lowercase, and digits expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "47672401706823533450263330817",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "7.55e8 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-alphanumeric-20",
      "title": "20-character uppercase, lowercase, and digits search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "704423425546998022968330264616370176",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "704,423,425,546,998,022,968,330,264,616,370,176",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 62^20.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-alphanumeric-20",
      "title": "20-character uppercase, lowercase, and digits modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "119.083926",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "119.08 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "20 × log2(62), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-20-online-model",
      "title": "20-character uppercase, lowercase, and digits exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "176105856386749505742082566154092544",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "2.23e26 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-20-online-model",
      "title": "20-character uppercase, lowercase, and digits expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "704423425546998022968330264616370177",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.12e26 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-20-offline-billion-model",
      "title": "20-character uppercase, lowercase, and digits exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "1375827003021480513610020048078848",
        "denominator": "1953125",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "2.23e19 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-20-offline-billion-model",
      "title": "20-character uppercase, lowercase, and digits expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "704423425546998022968330264616370177",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.12e19 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-20-offline-trillion-model",
      "title": "20-character uppercase, lowercase, and digits exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "171978375377685064201252506009856",
        "denominator": "244140625",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "2.23e16 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-20-offline-trillion-model",
      "title": "20-character uppercase, lowercase, and digits expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "704423425546998022968330264616370177",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.12e16 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-alphanumeric-24",
      "title": "24-character uppercase, lowercase, and digits search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "10408797222153426578715765348940396820955136",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "10,408,797,222,153,426,578,715,765,348,940,396,820,955,136",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 62^24.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-alphanumeric-24",
      "title": "24-character uppercase, lowercase, and digits modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "142.900711",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "142.90 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "24 × log2(62), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-24-online-model",
      "title": "24-character uppercase, lowercase, and digits exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "2602199305538356644678941337235099205238784",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.30e33 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-24-online-model",
      "title": "24-character uppercase, lowercase, and digits expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "10408797222153426578715765348940396820955137",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.65e33 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-24-offline-billion-model",
      "title": "24-character uppercase, lowercase, and digits exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "20329682074518411286554229197149212540928",
        "denominator": "1953125",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.30e26 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-24-offline-billion-model",
      "title": "24-character uppercase, lowercase, and digits expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "10408797222153426578715765348940396820955137",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.65e26 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-alphanumeric-24-offline-trillion-model",
      "title": "24-character uppercase, lowercase, and digits exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "2541210259314801410819278649643651567616",
        "denominator": "244140625",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.30e23 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-alphanumeric-24-offline-trillion-model",
      "title": "24-character uppercase, lowercase, and digits expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "10408797222153426578715765348940396820955137",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.65e23 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-printable-ascii-8",
      "title": "8-character printable ascii characters search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "6095689385410816",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "6,095,689,385,410,816",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 94^8.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-printable-ascii-8",
      "title": "8-character printable ascii characters modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "52.436711",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "52.44 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "8 × log2(94), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-8-online-model",
      "title": "8-character printable ascii characters exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "1523922346352704",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.93e6 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-8-online-model",
      "title": "8-character printable ascii characters expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "6095689385410817",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "965,803.7 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-8-offline-billion-model",
      "title": "8-character printable ascii characters exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "23811286661761",
        "denominator": "3906250",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "70.55 days",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-8-offline-billion-model",
      "title": "8-character printable ascii characters expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "6095689385410817",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "35.28 days",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-8-offline-trillion-model",
      "title": "8-character printable ascii characters exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "23811286661761",
        "denominator": "3906250000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.69 hours",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-8-offline-trillion-model",
      "title": "8-character printable ascii characters expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "6095689385410817",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "50.8 minutes",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-printable-ascii-12",
      "title": "12-character printable ascii characters search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "475920314814253376475136",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "475,920,314,814,253,376,475,136",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 94^12.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-printable-ascii-12",
      "title": "12-character printable ascii characters modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "78.655066",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "78.66 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "12 × log2(94), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-12-online-model",
      "title": "12-character printable ascii characters exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "118980078703563344118784",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.51e14 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-12-online-model",
      "title": "12-character printable ascii characters expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "475920314814253376475137",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "7.54e13 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-12-offline-billion-model",
      "title": "12-character printable ascii characters exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "929531864871588625928",
        "denominator": "1953125",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.51e7 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-12-offline-billion-model",
      "title": "12-character printable ascii characters expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "475920314814253376475137",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "7.54e6 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-12-offline-trillion-model",
      "title": "12-character printable ascii characters exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "116191483108948578241",
        "denominator": "244140625",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "15,081 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-12-offline-trillion-model",
      "title": "12-character printable ascii characters expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "475920314814253376475137",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "7,540.5 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-printable-ascii-16",
      "title": "16-character printable ascii characters search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "37157429083410091685945089785856",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "37,157,429,083,410,091,685,945,089,785,856",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 94^16.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-printable-ascii-16",
      "title": "16-character printable ascii characters modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "104.873422",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "104.87 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "16 × log2(94), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-16-online-model",
      "title": "16-character printable ascii characters exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "9289357270852522921486272446464",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.18e22 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-16-online-model",
      "title": "16-character printable ascii characters expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "37157429083410091685945089785857",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "5.89e21 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-16-offline-billion-model",
      "title": "16-character printable ascii characters exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "72573103678535335324111503488",
        "denominator": "1953125",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.18e15 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-16-offline-billion-model",
      "title": "16-character printable ascii characters expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "37157429083410091685945089785857",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "5.89e14 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-16-offline-trillion-model",
      "title": "16-character printable ascii characters exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "9071637959816916915513937936",
        "denominator": "244140625",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "1.18e12 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-16-offline-trillion-model",
      "title": "16-character printable ascii characters expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "37157429083410091685945089785857",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "5.89e11 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-printable-ascii-20",
      "title": "20-character printable ascii characters search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "2901062411314618233730627546741369470976",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "2,901,062,411,314,618,233,730,627,546,741,369,470,976",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 94^20.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-printable-ascii-20",
      "title": "20-character printable ascii characters modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "131.091777",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "131.09 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "20 × log2(94), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-20-online-model",
      "title": "20-character printable ascii characters exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "725265602828654558432656886685342367744",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "9.19e29 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-20-online-model",
      "title": "20-character printable ascii characters expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "2901062411314618233730627546741369470977",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "4.60e29 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-20-offline-billion-model",
      "title": "20-character printable ascii characters exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "5666137522098863737755131927229237248",
        "denominator": "1953125",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "9.19e22 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-20-offline-billion-model",
      "title": "20-character printable ascii characters expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "2901062411314618233730627546741369470977",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "4.60e22 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-20-offline-trillion-model",
      "title": "20-character printable ascii characters exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "708267190262357967219391490903654656",
        "denominator": "244140625",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "9.19e19 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-20-offline-trillion-model",
      "title": "20-character printable ascii characters expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "2901062411314618233730627546741369470977",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "4.60e19 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "space-printable-ascii-24",
      "title": "24-character printable ascii characters search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "226500146052898041878222437726567560344026218496",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "226,500,146,052,898,041,878,222,437,726,567,560,344,026,218,496",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "Exact integer exponentiation: 94^24.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "entropy-printable-ascii-24",
      "title": "24-character printable ascii characters modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "157.310132",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "157.31 bits",
      "assumptions": [
        "Every character is selected independently and uniformly from the stated alphabet."
      ],
      "methodology": "24 × log2(94), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-24-online-model",
      "title": "24-character printable ascii characters exhaustive-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "56625036513224510469555609431641890086006554624",
        "denominator": "25",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "7.18e37 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact search space divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-24-online-model",
      "title": "24-character printable ascii characters expected-search duration at Rate-limited model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "226500146052898041878222437726567560344026218497",
        "denominator": "200",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.59e37 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical input illustrating an online service with throttling; not a measured service rate."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 100 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-24-offline-billion-model",
      "title": "24-character printable ascii characters exhaustive-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "442383097759566488043403198684702266296926208",
        "denominator": "1953125",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "7.18e30 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-24-offline-billion-model",
      "title": "24-character printable ascii characters expected-search duration at Offline 1 billion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "226500146052898041878222437726567560344026218497",
        "denominator": "2000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.59e30 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "exhaustive-printable-ascii-24-offline-trillion-model",
      "title": "24-character printable ascii characters exhaustive-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "55297887219945811005425399835587783287115776",
        "denominator": "244140625",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "7.18e27 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The password is independently and uniformly generated from the stated alphabet.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact search space divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "expected-printable-ascii-24-offline-trillion-model",
      "title": "24-character printable ascii characters expected-search duration at Offline 1 trillion/s model",
      "finding_type": "computed",
      "numeric": {
        "kind": "rational",
        "numerator": "226500146052898041878222437726567560344026218497",
        "denominator": "2000000000000",
        "unit": "seconds",
        "is_exact": true
      },
      "display_value": "3.59e27 years",
      "assumptions": [
        "Every candidate is searched without shortcuts.",
        "The target is independently and uniformly positioned in the stated search space.",
        "Aggressive mathematical offline-search input; not a claim about named hardware or a particular password hash."
      ],
      "methodology": "Exact expected trials, (N + 1) / 2, divided by 1000000000000 guesses per second.",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-40-lowercase",
      "title": "Minimum lowercase letters length to reach 40 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "9",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "9 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 40 modeled bits."
      ],
      "methodology": "Ceiling of 40 / log2(26).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-40-alphanumeric",
      "title": "Minimum uppercase, lowercase, and digits length to reach 40 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "7",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "7 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 40 modeled bits."
      ],
      "methodology": "Ceiling of 40 / log2(62).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-40-printable-ascii",
      "title": "Minimum printable ascii characters length to reach 40 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "7",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "7 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 40 modeled bits."
      ],
      "methodology": "Ceiling of 40 / log2(94).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-60-lowercase",
      "title": "Minimum lowercase letters length to reach 60 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "13",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "13 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 60 modeled bits."
      ],
      "methodology": "Ceiling of 60 / log2(26).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-60-alphanumeric",
      "title": "Minimum uppercase, lowercase, and digits length to reach 60 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "11",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "11 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 60 modeled bits."
      ],
      "methodology": "Ceiling of 60 / log2(62).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-60-printable-ascii",
      "title": "Minimum printable ascii characters length to reach 60 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "10",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "10 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 60 modeled bits."
      ],
      "methodology": "Ceiling of 60 / log2(94).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-80-lowercase",
      "title": "Minimum lowercase letters length to reach 80 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "18",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "18 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 80 modeled bits."
      ],
      "methodology": "Ceiling of 80 / log2(26).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-80-alphanumeric",
      "title": "Minimum uppercase, lowercase, and digits length to reach 80 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "14",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "14 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 80 modeled bits."
      ],
      "methodology": "Ceiling of 80 / log2(62).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-80-printable-ascii",
      "title": "Minimum printable ascii characters length to reach 80 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "13",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "13 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 80 modeled bits."
      ],
      "methodology": "Ceiling of 80 / log2(94).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-100-lowercase",
      "title": "Minimum lowercase letters length to reach 100 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "22",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "22 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 100 modeled bits."
      ],
      "methodology": "Ceiling of 100 / log2(26).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-100-alphanumeric",
      "title": "Minimum uppercase, lowercase, and digits length to reach 100 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "17",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "17 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 100 modeled bits."
      ],
      "methodology": "Ceiling of 100 / log2(62).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-100-printable-ascii",
      "title": "Minimum printable ascii characters length to reach 100 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "16",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "16 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 100 modeled bits."
      ],
      "methodology": "Ceiling of 100 / log2(94).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-128-lowercase",
      "title": "Minimum lowercase letters length to reach 128 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "28",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "28 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 128 modeled bits."
      ],
      "methodology": "Ceiling of 128 / log2(26).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-128-alphanumeric",
      "title": "Minimum uppercase, lowercase, and digits length to reach 128 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "22",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "22 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 128 modeled bits."
      ],
      "methodology": "Ceiling of 128 / log2(62).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "minimum-length-128-printable-ascii",
      "title": "Minimum printable ascii characters length to reach 128 modeled bits",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "20",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "20 characters",
      "assumptions": [
        "Characters are selected independently and uniformly.",
        "The target is at least 128 modeled bits."
      ],
      "methodology": "Ceiling of 128 / log2(94).",
      "source_refs": [
        "release-1-model",
        "nist-sp-800-63b-4"
      ],
      "source_revision": "password-statistics-release-1-v1",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-passphrase-4-words",
      "title": "4-word EFF long-list passphrase search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "3656158440062976",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "3,656,158,440,062,976 combinations",
      "assumptions": [
        "Each word is selected independently and uniformly from all 7,776 entries.",
        "Separators and capitalization add no modeled entropy."
      ],
      "methodology": "Exact integer exponentiation: 7776^4; entropy is 4 × log2(7776).",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-passphrase-4-words-entropy",
      "title": "4-word EFF long-list passphrase modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "51.699250",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "51.70 bits",
      "assumptions": [
        "Each word is selected independently and uniformly from all 7,776 entries.",
        "Separators and capitalization add no modeled entropy."
      ],
      "methodology": "4 × log2(7776), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-passphrase-5-words",
      "title": "5-word EFF long-list passphrase search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "28430288029929701376",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "28,430,288,029,929,701,376 combinations",
      "assumptions": [
        "Each word is selected independently and uniformly from all 7,776 entries.",
        "Separators and capitalization add no modeled entropy."
      ],
      "methodology": "Exact integer exponentiation: 7776^5; entropy is 5 × log2(7776).",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-passphrase-5-words-entropy",
      "title": "5-word EFF long-list passphrase modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "64.624063",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "64.62 bits",
      "assumptions": [
        "Each word is selected independently and uniformly from all 7,776 entries.",
        "Separators and capitalization add no modeled entropy."
      ],
      "methodology": "5 × log2(7776), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-passphrase-6-words",
      "title": "6-word EFF long-list passphrase search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "221073919720733357899776",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "221,073,919,720,733,357,899,776 combinations",
      "assumptions": [
        "Each word is selected independently and uniformly from all 7,776 entries.",
        "Separators and capitalization add no modeled entropy."
      ],
      "methodology": "Exact integer exponentiation: 7776^6; entropy is 6 × log2(7776).",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-passphrase-6-words-entropy",
      "title": "6-word EFF long-list passphrase modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "77.548875",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "77.55 bits",
      "assumptions": [
        "Each word is selected independently and uniformly from all 7,776 entries.",
        "Separators and capitalization add no modeled entropy."
      ],
      "methodology": "6 × log2(7776), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-passphrase-8-words",
      "title": "8-word EFF long-list passphrase search space",
      "finding_type": "computed",
      "numeric": {
        "kind": "integer",
        "value": "13367494538843734067838845976576",
        "unit": "combinations",
        "is_exact": true
      },
      "display_value": "13,367,494,538,843,734,067,838,845,976,576 combinations",
      "assumptions": [
        "Each word is selected independently and uniformly from all 7,776 entries.",
        "Separators and capitalization add no modeled entropy."
      ],
      "methodology": "Exact integer exponentiation: 7776^8; entropy is 8 × log2(7776).",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-passphrase-8-words-entropy",
      "title": "8-word EFF long-list passphrase modeled entropy",
      "finding_type": "computed",
      "numeric": {
        "kind": "decimal",
        "value": "103.398500",
        "unit": "bits",
        "is_exact": false,
        "decimal_places": 6,
        "rounding": "nearest"
      },
      "display_value": "103.40 bits",
      "assumptions": [
        "Each word is selected independently and uniformly from all 7,776 entries.",
        "Separators and capitalization add no modeled entropy."
      ],
      "methodology": "8 × log2(7776), rounded to six decimal places in the canonical value.",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": null,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-word-count",
      "title": "EFF long-list population",
      "finding_type": "empirical-census",
      "numeric": {
        "kind": "integer",
        "value": "7776",
        "unit": "words",
        "is_exact": true
      },
      "display_value": "7,776 words",
      "assumptions": [
        "Length is counted as JavaScript string code units; the source words contain lowercase ASCII letters and hyphens."
      ],
      "methodology": "Count every validated source row.",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": 7776,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-minimum-word-length",
      "title": "Shortest EFF long-list word length",
      "finding_type": "empirical-census",
      "numeric": {
        "kind": "integer",
        "value": "3",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "3 characters",
      "assumptions": [
        "Length is counted as JavaScript string code units; the source words contain lowercase ASCII letters and hyphens."
      ],
      "methodology": "Take the minimum length across all words.",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": 7776,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-maximum-word-length",
      "title": "Longest EFF long-list word length",
      "finding_type": "empirical-census",
      "numeric": {
        "kind": "integer",
        "value": "9",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "9 characters",
      "assumptions": [
        "Length is counted as JavaScript string code units; the source words contain lowercase ASCII letters and hyphens."
      ],
      "methodology": "Take the maximum length across all words.",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": 7776,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-mean-word-length",
      "title": "Mean EFF long-list word length",
      "finding_type": "empirical-census",
      "numeric": {
        "kind": "rational",
        "numerator": "1699",
        "denominator": "243",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "6.99",
      "assumptions": [
        "Length is counted as JavaScript string code units; the source words contain lowercase ASCII letters and hyphens."
      ],
      "methodology": "Sum all word lengths and divide by the population.",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": 7776,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    },
    {
      "id": "eff-median-word-length",
      "title": "Median EFF long-list word length",
      "finding_type": "empirical-census",
      "numeric": {
        "kind": "rational",
        "numerator": "7",
        "denominator": "1",
        "unit": "characters",
        "is_exact": true
      },
      "display_value": "7.0",
      "assumptions": [
        "Length is counted as JavaScript string code units; the source words contain lowercase ASCII letters and hyphens."
      ],
      "methodology": "Average the two center values of the sorted even-sized population.",
      "source_refs": [
        "eff-long-wordlist-2016-07-18"
      ],
      "source_revision": "addd35536511597a02fa0a9ff1e5284677b8883b83e986e43f15a3db996b903e",
      "generated_at": "2026-10-21T16:00:00Z",
      "last_verified_at": "2026-10-21",
      "sample_size": 7776,
      "confidence_interval": null,
      "calculation_version": "1.0.0",
      "reproducibility_ref": "research/scripts/generate-release-1.mjs"
    }
  ]
}