{ "release_id": "website-password-requirements-2026-v1", "released_on": "2026-10-22", "title": "Publicly documented password requirements across 100 consumer services", "scope": "Ten recognizable consumer account services were preselected in each of ten sectors for breadth. This is not a traffic ranking or a representative sample of all websites.", "review_note": "Each record received a separate evidence-review pass by the same researcher who collected it. The release has not been independently replicated.", "totals": { "sampled_sites": 100, "sectors": 10, "evidence_records": 113, "not_testable": 13 }, "control_coverage": { "minimum_length": { "known": 20, "yes": 0, "no": 0, "unknown": 72, "not_applicable": 8 }, "maximum_length": { "known": 7, "yes": 0, "no": 0, "unknown": 85, "not_applicable": 8 }, "composition_rule": { "known": 0, "yes": 14, "no": 2, "unknown": 76, "not_applicable": 8 }, "spaces_accepted": { "known": 0, "yes": 0, "no": 2, "unknown": 91, "not_applicable": 7 }, "unicode_accepted": { "known": 0, "yes": 0, "no": 2, "unknown": 91, "not_applicable": 7 }, "password_manager_allowed": { "known": 0, "yes": 16, "no": 0, "unknown": 77, "not_applicable": 7 }, "autofill_allowed": { "known": 0, "yes": 1, "no": 0, "unknown": 92, "not_applicable": 7 }, "paste_allowed": { "known": 0, "yes": 0, "no": 0, "unknown": 93, "not_applicable": 7 }, "periodic_change_required": { "known": 0, "yes": 0, "no": 0, "unknown": 100, "not_applicable": 0 }, "compromised_password_screening_disclosed": { "known": 0, "yes": 10, "no": 0, "unknown": 90, "not_applicable": 0 }, "passkey_available": { "known": 0, "yes": 37, "no": 0, "unknown": 63, "not_applicable": 0 } }, "minimum_length_distribution": { "6": 3, "8": 14, "10": 2, "11": 1 }, "maximum_length_distribution": { "20": 3, "60": 1, "72": 1, "99": 1, "128": 1 }, "by_sector": { "financial-services": { "sites": 10, "documented_minimum": 2, "documented_maximum": 2, "passkey_available": 6, "compromised_password_screening_disclosed": 1, "not_testable": 0 }, "retail-marketplaces": { "sites": 10, "documented_minimum": 2, "documented_maximum": 1, "passkey_available": 3, "compromised_password_screening_disclosed": 0, "not_testable": 2 }, "social-communication": { "sites": 10, "documented_minimum": 0, "documented_maximum": 0, "passkey_available": 6, "compromised_password_screening_disclosed": 0, "not_testable": 1 }, "streaming-media": { "sites": 10, "documented_minimum": 4, "documented_maximum": 1, "passkey_available": 0, "compromised_password_screening_disclosed": 1, "not_testable": 1 }, "travel-mobility": { "sites": 10, "documented_minimum": 0, "documented_maximum": 0, "passkey_available": 3, "compromised_password_screening_disclosed": 0, "not_testable": 3 }, "productivity-cloud": { "sites": 10, "documented_minimum": 3, "documented_maximum": 1, "passkey_available": 8, "compromised_password_screening_disclosed": 2, "not_testable": 0 }, "developer-services": { "sites": 10, "documented_minimum": 4, "documented_maximum": 1, "passkey_available": 4, "compromised_password_screening_disclosed": 3, "not_testable": 0 }, "gaming": { "sites": 10, "documented_minimum": 3, "documented_maximum": 1, "passkey_available": 5, "compromised_password_screening_disclosed": 2, "not_testable": 1 }, "education-knowledge": { "sites": 10, "documented_minimum": 1, "documented_maximum": 0, "passkey_available": 1, "compromised_password_screening_disclosed": 1, "not_testable": 2 }, "health-fitness": { "sites": 10, "documented_minimum": 1, "documented_maximum": 0, "passkey_available": 1, "compromised_password_screening_disclosed": 0, "not_testable": 3 } }, "observations": [ { "id": "paypal", "name": "PayPal", "domain": "paypal.com", "sector": "financial-services", "service_region": "North America", "account_context": "Consumer account; password values come from an English-language regional PayPal help page and require locale review.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": 20, "composition_rule": "yes", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "paypal-password", "type": "official_documentation", "url": "https://www.paypal.com/gi/cshelp/article/why-cant-i-view-my-password-help681", "title": "Why can't I view my password?", "accessed_on": "2026-10-22", "paraphrase": "The regional help page states an 8-to-20-character password and requires at least one number or symbol.", "archived_url": null }, { "id": "paypal-passkey", "type": "official_documentation", "url": "https://www.paypal.com/us/cshelp/article/what-is-a-passkey-and-how-do-i-use-it-to-log-in-to-my-paypal-account-help997", "title": "What is a passkey and how do I use it to log in to my PayPal account?", "accessed_on": "2026-10-22", "paraphrase": "PayPal documents passkey sign-in for eligible consumer accounts and supported devices.", "archived_url": null } ], "notes": "A separate PayPal guidance page says more than eight characters and describes a broader character mix. Review must resolve whether requirements vary by locale." }, { "id": "venmo", "name": "Venmo", "domain": "venmo.com", "sector": "financial-services", "service_region": "North America", "account_context": "Personal account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "venmo-sign-in", "type": "official_documentation", "url": "https://help.venmo.com/cs/articles/signing-in-faq-vhel229", "title": "Signing In FAQ", "accessed_on": "2026-10-22", "paraphrase": "Venmo confirms that personal accounts sign in with an identifier and password, but this page does not document password construction rules.", "archived_url": null } ], "notes": "No official public password-requirements page was located in the initial source pass." }, { "id": "cash-app", "name": "Cash App", "domain": "cash.app", "sector": "financial-services", "service_region": "North America", "account_context": "US consumer Cash App account using the documented confirmation-code and Cash PIN flow.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "not_applicable", "maximum_length": "not_applicable", "composition_rule": "not_applicable", "spaces_accepted": "not_applicable", "unicode_accepted": "not_applicable", "password_manager_allowed": "not_applicable", "autofill_allowed": "not_applicable", "paste_allowed": "not_applicable", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "cash-app-account", "type": "official_documentation", "url": "https://cash.app/learn/getting-started/what-is-cash-app-and-how-does-it-work", "title": "What is Cash App and How Does it Work?", "accessed_on": "2026-10-22", "paraphrase": "Cash App documents signup by confirmation code followed by a four-digit Cash PIN for login, rather than a password.", "archived_url": null } ], "notes": "Passkey availability and PIN-specific policy are outside the password fields and remain unestablished." }, { "id": "wise", "name": "Wise", "domain": "wise.com", "sector": "financial-services", "service_region": "Europe", "account_context": "Consumer account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "wise-passkey", "type": "official_documentation", "url": "https://wise.com/help/articles/4OTG2Z93XXyaurUviZRg5O/how-can-i-use-a-passkey", "title": "How can I use a passkey?", "accessed_on": "2026-10-22", "paraphrase": "Wise documents passkey setup and login, including supported browsers, devices, and credential managers.", "archived_url": null } ], "notes": "Wise publishes password advice, but the initial source pass did not establish enforced length or composition rules." }, { "id": "revolut", "name": "Revolut", "domain": "revolut.com", "sector": "financial-services", "service_region": "Europe", "account_context": "US personal account using the documented passcode and passkey flow.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "not_applicable", "maximum_length": "not_applicable", "composition_rule": "not_applicable", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "revolut-passkey", "type": "official_documentation", "url": "https://help.revolut.com/en-US/help/profile-and-plan/log-in-issues/what-are-passkeys/", "title": "What are passkeys?", "accessed_on": "2026-10-22", "paraphrase": "Revolut documents passkeys and describes passcode plus two-factor authentication as the fallback login method.", "archived_url": null } ], "notes": "A passcode is not treated as a password for this study. Review must confirm the sampled US account context." }, { "id": "klarna", "name": "Klarna", "domain": "klarna.com", "sector": "financial-services", "service_region": "Europe", "account_context": "UK consumer account; passkey availability may vary by market.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "klarna-security", "type": "official_documentation", "url": "https://www.klarna.com/uk/security/", "title": "Security comes as standard", "accessed_on": "2026-10-22", "paraphrase": "Klarna's UK security page says consumer accounts can use biometrics and passkeys.", "archived_url": null } ], "notes": "The initial source pass did not establish enforceable password construction rules." }, { "id": "coinbase", "name": "Coinbase", "domain": "coinbase.com", "sector": "financial-services", "service_region": "North America", "account_context": "Coinbase consumer account, excluding Exchange and Prime-specific account types.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": 72, "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "yes", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "yes", "passkey_available": "yes" }, "evidence": [ { "id": "coinbase-password", "type": "official_documentation", "url": "https://help.coinbase.com/en/pro/privacy-and-security/avoiding-phishing-and-scams/password-requirements", "title": "Password requirements", "accessed_on": "2026-10-22", "paraphrase": "Coinbase states a minimum of eight characters, truncation beyond 72 characters, no arbitrary character restrictions, password-manager support, autofill, and checking against leaked-password data.", "archived_url": null }, { "id": "coinbase-passkey", "type": "official_documentation", "url": "https://help.coinbase.com/en/coinbase/getting-started/getting-started-with-coinbase/2-step-verification", "title": "Set up your 2-step verification", "accessed_on": "2026-10-22", "paraphrase": "Coinbase documents passkeys as an available two-step verification method for consumer accounts.", "archived_url": null } ], "notes": "Another Coinbase help page describes uppercase, lowercase, number, and symbol requirements. Composition remains unknown pending conflict resolution. The 72-character value is an effective processing boundary because longer input is documented as truncated." }, { "id": "robinhood", "name": "Robinhood", "domain": "robinhood.com", "sector": "financial-services", "service_region": "North America", "account_context": "US consumer brokerage account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "robinhood-password", "type": "official_documentation", "url": "https://robinhood.com/us/en/support/articles/best-practices/", "title": "Security best practices", "accessed_on": "2026-10-22", "paraphrase": "Robinhood recommends password-manager generation and storage and describes a strong password as at least ten characters with multiple character classes.", "archived_url": null }, { "id": "robinhood-passkey", "type": "official_documentation", "url": "https://robinhood.com/us/en/support/articles/passkeys/", "title": "Passkeys", "accessed_on": "2026-10-22", "paraphrase": "Robinhood documents passkey login for supported iOS devices.", "archived_url": null } ], "notes": "The strong-password page is phrased as guidance, so length and composition are not recorded as enforced requirements." }, { "id": "monzo", "name": "Monzo", "domain": "monzo.com", "sector": "financial-services", "service_region": "Europe", "account_context": "UK personal account using magic-link, PIN, and biometric authentication.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "not_applicable", "maximum_length": "not_applicable", "composition_rule": "not_applicable", "spaces_accepted": "not_applicable", "unicode_accepted": "not_applicable", "password_manager_allowed": "not_applicable", "autofill_allowed": "not_applicable", "paste_allowed": "not_applicable", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "monzo-login", "type": "official_documentation", "url": "https://monzo.com/help/monzo-fraud-category/keep-your-account-safe", "title": "How we keep your account safe", "accessed_on": "2026-10-22", "paraphrase": "Monzo states that it uses emailed magic links and does not ask customers for a password.", "archived_url": null } ], "notes": "Passkey availability was not established in the initial source pass." }, { "id": "n26", "name": "N26", "domain": "n26.com", "sector": "financial-services", "service_region": "Europe", "account_context": "European consumer account; source is the Austrian English support edition.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "n26-password", "type": "official_documentation", "url": "https://support.n26.com/en-at/security/passwords-and-codes/how-to-change-your-password", "title": "How to change your password?", "accessed_on": "2026-10-22", "paraphrase": "N26 says passwords must be accepted by a robustness algorithm and recommends passphrases, but does not publish exact enforceable thresholds on this page.", "archived_url": null } ], "notes": "Exact length, composition, and passkey values remain unknown." }, { "id": "amazon", "name": "Amazon", "domain": "amazon.com", "sector": "retail-marketplaces", "service_region": "North America", "account_context": "US Amazon consumer account; the available rule page is published by Amazon Pay and says its account settings are shared with Amazon.com.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "amazon-password-guidance", "type": "official_documentation", "url": "https://pay.amazon.com/help/201754750", "title": "Password security", "accessed_on": "2026-10-22", "paraphrase": "Amazon Pay publishes six-character and character-mix guidance for the Amazon password, but the page presents the statements as guidelines rather than an explicit validation specification.", "archived_url": null }, { "id": "amazon-account-link", "type": "official_documentation", "url": "https://pay.amazon.com/help/201754680", "title": "Managing your Amazon account for Amazon Pay", "accessed_on": "2026-10-22", "paraphrase": "Amazon states that Amazon Pay uses Amazon credentials and that account-setting changes apply to both Amazon Pay and Amazon websites.", "archived_url": null } ], "notes": "Minimum length and composition remain unknown until review confirms that the guidance describes enforced consumer-account rules. The page also recommends 90-day changes, which is not treated as a required periodic-change control." }, { "id": "walmart", "name": "Walmart", "domain": "walmart.com", "sector": "retail-marketplaces", "service_region": "North America", "account_context": "US Walmart.com consumer account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": "unknown", "composition_rule": "yes", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "walmart-password", "type": "official_documentation", "url": "https://www.walmart.com/help/article/manage-password/35d7915384d44826ab2ccb7d7a69493c", "title": "Manage Password", "accessed_on": "2026-10-22", "paraphrase": "Walmart's reset instructions require eight characters, uppercase and lowercase letters, and at least one number or special character.", "archived_url": null }, { "id": "walmart-passkey", "type": "official_documentation", "url": "https://www.walmart.com/help/article/passkeys/79bc4a57374146c497ebe3bf8d4f9b10", "title": "Passkeys", "accessed_on": "2026-10-22", "paraphrase": "Walmart documents passkey creation and passkey sign-in for Walmart accounts.", "archived_url": null } ], "notes": "The published rule is a reset-flow requirement. Maximum length and input-handling controls remain unknown." }, { "id": "ebay", "name": "eBay", "domain": "ebay.com", "sector": "retail-marketplaces", "service_region": "North America", "account_context": "US eBay consumer account; passkeys may need separate setup on other eBay marketplaces.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "ebay-security", "type": "official_documentation", "url": "https://www.ebay.com/help/account/account-safety/protecting-account?id=4872", "title": "Tips for keeping your eBay account secure", "accessed_on": "2026-10-22", "paraphrase": "eBay documents passkey sign-in and gives general password advice, but does not state exact enforceable password construction rules on this page.", "archived_url": null } ], "notes": "The recommendation to update a password regularly is advice, not evidence that periodic changes are required." }, { "id": "etsy", "name": "Etsy", "domain": "etsy.com", "sector": "retail-marketplaces", "service_region": "North America", "account_context": "Etsy consumer marketplace account; source is the English UK help edition.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "etsy-security-code", "type": "official_documentation", "url": "https://help.etsy.com/hc/en-gb/articles/360059447973-I-Received-a-Security-Code-Email-from-Etsy", "title": "I Received a Security Code Email from Etsy", "accessed_on": "2026-10-22", "paraphrase": "Etsy recommends at least eight characters and a mix of character classes when discussing account recovery, but the wording does not establish an enforced validation rule.", "archived_url": null } ], "notes": "Length and composition remain unknown because the official source is advice. Passkey availability was not established." }, { "id": "target", "name": "Target", "domain": "target.com", "sector": "retail-marketplaces", "service_region": "North America", "account_context": "US Target.com and Target app consumer account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": 20, "composition_rule": "yes", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "target-create-account", "type": "official_documentation", "url": "https://help.target.com/help/targetguesthelparticledetail?articleId=ka95d0000000Rq9AAE&articleTitle=How+do+I+create+a+Target+account%3F&clickSearchVar=Search+Results&searchQuery=can+someone+else+pick+up+my+order", "title": "How do I create a Target account?", "accessed_on": "2026-10-22", "paraphrase": "Target states that account passwords must contain 8 to 20 characters and two of four character classes, with angle brackets excluded from the special-character option.", "archived_url": null }, { "id": "target-reset-password", "type": "official_documentation", "url": "https://help.target.com/help/subcategoryarticle?childcat=Reset+password&parentcat=Target+Account", "title": "Reset password", "accessed_on": "2026-10-22", "paraphrase": "Target's account help page offers passkey sign-in using a fingerprint, face, or device PIN.", "archived_url": null } ], "notes": "The character-class rule is recorded as a composition requirement; the allowed-character exception should be preserved in any narrative report." }, { "id": "aliexpress", "name": "AliExpress", "domain": "aliexpress.com", "sector": "retail-marketplaces", "service_region": "Asia-Pacific", "account_context": "AliExpress consumer marketplace account.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The initial source pass did not locate an accessible official page that states password requirements. This is not yet a final not-testable determination." }, { "id": "temu", "name": "Temu", "domain": "temu.com", "sector": "retail-marketplaces", "service_region": "Asia-Pacific", "account_context": "Temu consumer account; official help editions publish different minimums by locale.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "temu-portugal-password", "type": "official_documentation", "url": "https://www.temu.com/pt/support/c3/como--alterar-a---passe-f-54-s-107.html", "title": "How can I change my password?", "accessed_on": "2026-10-22", "paraphrase": "Temu's Portugal help edition states an eight-character minimum in its password-change guidance.", "archived_url": null }, { "id": "temu-croatia-password", "type": "official_documentation", "url": "https://www.temu.com/hr-en/support/c3/how-can-i-reset--f-55-s-136.html", "title": "How can I reset my password?", "accessed_on": "2026-10-22", "paraphrase": "Temu's Croatia English help edition states a six-character minimum, conflicting with another regional help edition.", "archived_url": null } ], "notes": "No global minimum is asserted. Review should either define a single locale-specific account context or report the documented regional difference." }, { "id": "shein", "name": "SHEIN", "domain": "shein.com", "sector": "retail-marketplaces", "service_region": "Asia-Pacific", "account_context": "US SHEIN consumer account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "shein-account-interface", "type": "official_documentation", "url": "https://us.shein.com/robot?cdn_rsite=cf&page=navigationBar&page_name=page_home&rep=dir&ret=us", "title": "SHEIN customer service", "accessed_on": "2026-10-22", "paraphrase": "SHEIN's US customer-service interface distinguishes password and verification-code sign-in but does not publish password construction rules.", "archived_url": null } ], "notes": "The initial source pass did not establish enforceable password rules or passkey availability." }, { "id": "mercado-libre", "name": "Mercado Libre", "domain": "mercadolibre.com", "sector": "retail-marketplaces", "service_region": "Latin America", "account_context": "Mercado Libre Global Selling business account; this does not yet match the intended consumer marketplace context.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "mercado-libre-registration", "type": "official_documentation", "url": "https://global-selling.mercadolibre.com/hub/registration?contextual=cbt_open&entity=pj", "title": "Complete the information to start selling in Latin America", "accessed_on": "2026-10-22", "paraphrase": "The official Global Selling registration page includes password creation but does not expose construction rules in the accessible page text.", "archived_url": null } ], "notes": "Review must find evidence for a consumer account in a named national marketplace or mark the site not testable within the collection boundary." }, { "id": "rakuten", "name": "Rakuten", "domain": "rakuten.co.jp", "sector": "retail-marketplaces", "service_region": "Asia-Pacific", "account_context": "Rakuten consumer account in Japan.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The initial English-language source pass did not locate an official consumer-account page stating password rules. Japanese-language review remains outstanding." }, { "id": "facebook", "name": "Facebook", "domain": "facebook.com", "sector": "social-communication", "service_region": "North America", "account_context": "Facebook personal account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "facebook-security-key", "type": "official_documentation", "url": "https://www.facebook.com/help/1167409720358611", "title": "Add a security key to your Facebook account", "accessed_on": "2026-10-22", "paraphrase": "Facebook documents FIDO2 hardware security keys as a login and two-factor option, but this is not enough to classify general passkey availability.", "archived_url": null } ], "notes": "Password requirements and consumer passkey availability remain unknown. A FIDO2 security-key feature is not automatically counted as passkey login." }, { "id": "instagram", "name": "Instagram", "domain": "instagram.com", "sector": "social-communication", "service_region": "North America", "account_context": "Instagram personal account.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The initial source pass did not locate an accessible official Instagram help page stating password requirements or passkey availability. Accounts Center documentation alone is insufficient." }, { "id": "x", "name": "X", "domain": "x.com", "sector": "social-communication", "service_region": "North America", "account_context": "X personal account using the current iOS or Android app.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "x-passkey", "type": "official_documentation", "url": "https://help.x.com/en/managing-your-account/how-to-use-passkey", "title": "How to use passkey", "accessed_on": "2026-10-22", "paraphrase": "X documents optional passkey login and says the feature is available on iOS and Android.", "archived_url": null } ], "notes": "The source does not state enforceable password construction rules." }, { "id": "tiktok", "name": "TikTok", "domain": "tiktok.com", "sector": "social-communication", "service_region": "Asia-Pacific", "account_context": "TikTok personal account on a supported Android or Apple device.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "tiktok-passkey", "type": "official_documentation", "url": "https://support.tiktok.com/en/log-in-troubleshoot/log-in/log-in-with-a-passkey", "title": "Log in with a passkey", "accessed_on": "2026-10-22", "paraphrase": "TikTok documents passkey setup and login on supported Android and Apple devices.", "archived_url": null } ], "notes": "The source does not state enforceable password construction rules." }, { "id": "linkedin", "name": "LinkedIn", "domain": "linkedin.com", "sector": "social-communication", "service_region": "North America", "account_context": "LinkedIn member account; passkey availability can depend on device support and feature rollout.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "linkedin-passkey", "type": "official_documentation", "url": "https://www.linkedin.com/help/linkedin/answer/a1621596", "title": "Set up and use a passkey to sign in", "accessed_on": "2026-10-22", "paraphrase": "LinkedIn documents passkey creation and passwordless sign-in for eligible accounts and devices.", "archived_url": null }, { "id": "linkedin-password-guidance", "type": "official_documentation", "url": "https://www.linkedin.com/help/linkedin/answer/a1375084", "title": "Account security best practices", "accessed_on": "2026-10-22", "paraphrase": "LinkedIn recommends at least eight characters, a character mix, and considering a password manager, but labels the page as best-practice recommendations.", "archived_url": null } ], "notes": "Recommended length, composition, and password-manager use are not recorded as enforced or directly observed controls." }, { "id": "reddit", "name": "Reddit", "domain": "reddit.com", "sector": "social-communication", "service_region": "North America", "account_context": "Reddit personal account created by email or phone; Reddit does not support passkey-only accounts.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "reddit-passkey", "type": "official_documentation", "url": "https://support.reddithelp.com/hc/en-us/articles/49063461551252-What-are-passkeys-and-how-do-I-set-it-up", "title": "What are passkeys and how do I set it up?", "accessed_on": "2026-10-22", "paraphrase": "Reddit documents optional passkey setup and login for new and existing accounts while retaining a password or one-time-code recovery method.", "archived_url": null } ], "notes": "The source does not state enforceable password construction rules." }, { "id": "discord", "name": "Discord", "domain": "discord.com", "sector": "social-communication", "service_region": "North America", "account_context": "Discord consumer account on a supported mobile or desktop platform.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "discord-passkey", "type": "official_documentation", "url": "https://support.discord.com/hc/en-us/articles/25966860846231-Security-Keys-Passkeys-and-Passwordless-Login-on-Discord", "title": "Security Keys, Passkeys, and Passwordless Login on Discord", "accessed_on": "2026-10-22", "paraphrase": "Discord documents passkey registration and one-step passwordless login on supported mobile and desktop platforms.", "archived_url": null } ], "notes": "The source does not state enforceable password construction rules." }, { "id": "snapchat", "name": "Snapchat", "domain": "snapchat.com", "sector": "social-communication", "service_region": "North America", "account_context": "Snapchat personal account; passkeys are documented as a gradual rollout.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "snapchat-passkey", "type": "official_documentation", "url": "https://help.snapchat.com/hc/en-us/articles/27317385968532-How-do-I-use-Passkeys-on-Snapchat", "title": "How do I use Passkeys on Snapchat?", "accessed_on": "2026-10-22", "paraphrase": "Snapchat documents passkey enrollment and login but warns that the feature is rolling out and may not yet be available to every account.", "archived_url": null }, { "id": "snapchat-password-guidance", "type": "official_documentation", "url": "https://help.snapchat.com/hc/en-us/articles/7012304746644-What-steps-can-I-take-to-help-protect-my-security-and-safety-on-Snapchat", "title": "What steps can I take to help protect my security and safety on Snapchat?", "accessed_on": "2026-10-22", "paraphrase": "Snapchat advises selecting a password of at least eight characters with a character mix, but the page is security guidance rather than an explicit validation specification.", "archived_url": null } ], "notes": "Length and composition remain unknown until review distinguishes advice from enforced requirements. The passkey finding must be described as rollout-dependent." }, { "id": "pinterest", "name": "Pinterest", "domain": "pinterest.com", "sector": "social-communication", "service_region": "North America", "account_context": "Pinterest personal account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "pinterest-password-reset", "type": "official_documentation", "url": "https://help.pinterest.com/en/article/reset-your-password", "title": "Reset or change your password", "accessed_on": "2026-10-22", "paraphrase": "Pinterest states that recently used passwords cannot be reused, but does not give a history depth or exact password construction rules.", "archived_url": null } ], "notes": "Password history is not one of the current structured controls. Passkey availability and exact construction rules remain unknown." }, { "id": "tumblr", "name": "Tumblr", "domain": "tumblr.com", "sector": "social-communication", "service_region": "North America", "account_context": "Tumblr personal account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "tumblr-account-security", "type": "official_documentation", "url": "https://help.tumblr.com/knowledge-base/protecting-your-account/", "title": "Protecting Your Account", "accessed_on": "2026-10-22", "paraphrase": "Tumblr strongly recommends using a password manager to generate and handle account passwords and describes long password-manager-generated values.", "archived_url": null } ], "notes": "The official guidance establishes that password managers are supported in normal account use, but it does not state an enforced minimum or maximum." }, { "id": "netflix", "name": "Netflix", "domain": "netflix.com", "sector": "streaming-media", "service_region": "North America", "account_context": "Netflix account-owner password; profile users may also use emailed or texted sign-in codes.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": 60, "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "yes", "passkey_available": "unknown" }, "evidence": [ { "id": "netflix-password-screening", "type": "official_documentation", "url": "https://help.netflix.com/en/node/128825", "title": "Netflix says 'This password is not secure or is too common.'", "accessed_on": "2026-10-22", "paraphrase": "Netflix says it rejects passwords found on a compromised-or-common-password list, recommends at least eight characters and a character mix, and says password managers can help.", "archived_url": null }, { "id": "netflix-length-error", "type": "official_documentation", "url": "https://help.netflix.com/de/node/54078", "title": "Netflix message: Your password must be between 6 and 60 characters", "accessed_on": "2026-10-22", "paraphrase": "A Netflix help page documents a validation error stating a six-to-60-character range.", "archived_url": null } ], "notes": "The official pages conflict on whether the effective minimum is six or eight, so minimum length and composition remain unresolved. The 60-character maximum is explicitly documented." }, { "id": "spotify", "name": "Spotify", "domain": "spotify.com", "sector": "streaming-media", "service_region": "Europe", "account_context": "Spotify consumer account; users may also sign in through Apple, Google, Facebook, or a phone number.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "spotify-security-guidance", "type": "official_documentation", "url": "https://support.spotify.com/jm/article/protect-your-account/", "title": "Protect your Spotify account", "accessed_on": "2026-10-22", "paraphrase": "Spotify recommends a long mixed-character password and frequent changes but does not state enforceable construction rules on this page.", "archived_url": null } ], "notes": "Advice is not recorded as an enforced length, composition, or periodic-change requirement. Passkey availability was not established." }, { "id": "disney-plus", "name": "Disney+", "domain": "disneyplus.com", "sector": "streaming-media", "service_region": "North America", "account_context": "Disney+ consumer account using the shared MyDisney login.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 6, "maximum_length": "unknown", "composition_rule": "yes", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "disney-password", "type": "official_documentation", "url": "https://help.disneyplus.com/article/disneyplus-change-password", "title": "Change or reset your Disney+ password", "accessed_on": "2026-10-22", "paraphrase": "Disney+ requires at least six case-sensitive characters and at least one number or special character and recommends trusted password managers.", "archived_url": null } ], "notes": "Changing the Disney+ password also changes the shared MyDisney login." }, { "id": "hulu", "name": "Hulu", "domain": "hulu.com", "sector": "streaming-media", "service_region": "North America", "account_context": "Hulu consumer account using the shared MyDisney login.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 6, "maximum_length": "unknown", "composition_rule": "yes", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "hulu-account-security", "type": "official_documentation", "url": "https://help.hulu.com/article/hulu-account-security", "title": "Account security on Hulu", "accessed_on": "2026-10-22", "paraphrase": "Hulu says signup passwords must have at least six case-sensitive characters and include at least one number or special character.", "archived_url": null } ], "notes": "The credential is shared across participating MyDisney services." }, { "id": "max", "name": "Max", "domain": "max.com", "sector": "streaming-media", "service_region": "North America", "account_context": "Max consumer streaming account; source is the Middle East English help edition.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "max-password-guidance", "type": "official_documentation", "url": "https://help.max.com/me-en/Answer/Detail/000002509", "title": "Help keep your account secure", "accessed_on": "2026-10-22", "paraphrase": "Max recommends at least ten characters and no more than four repeating characters in a row but presents these as recommendations.", "archived_url": null } ], "notes": "The source does not prove the guidance is enforced. Its recommendation to change passwords periodically is not counted as a required periodic change." }, { "id": "peacock", "name": "Peacock", "domain": "peacocktv.com", "sector": "streaming-media", "service_region": "North America", "account_context": "US Peacock consumer account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 10, "maximum_length": "unknown", "composition_rule": "yes", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "peacock-password", "type": "official_documentation", "url": "https://www.peacocktv.com/help/article/how-do-i-reset-my-password", "title": "How do I reset my Peacock password?", "accessed_on": "2026-10-22", "paraphrase": "Peacock states passwords must be at least ten characters and contain both letters and numbers.", "archived_url": null } ], "notes": "Additional mixed-character advice is not treated as a broader enforced composition rule beyond letters and numbers." }, { "id": "twitch", "name": "Twitch", "domain": "twitch.tv", "sector": "streaming-media", "service_region": "North America", "account_context": "Twitch consumer account created with a traditional email or phone signup rather than social login.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "twitch-strong-password", "type": "official_documentation", "url": "https://help.twitch.tv/s/article/creating-a-strong-password?language=es", "title": "How to create a strong password", "accessed_on": "2026-10-22", "paraphrase": "Twitch says it requires a minimum of eight characters and explicitly recommends password-manager-generated passwords.", "archived_url": null } ], "notes": "The accessible source is Twitch's Spanish help edition. Social-login accounts have a different credential context." }, { "id": "soundcloud", "name": "SoundCloud", "domain": "soundcloud.com", "sector": "streaming-media", "service_region": "Europe", "account_context": "SoundCloud consumer account with an email password; social sign-in is also available.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "soundcloud-password-reset", "type": "official_documentation", "url": "https://help.soundcloud.com/hc/pt-br/articles/115003446087-Redefinindo-sua-senha", "title": "Resetting your password", "accessed_on": "2026-10-22", "paraphrase": "SoundCloud's Portuguese help edition recommends password managers for generating and storing account passwords but gives no exact enforced thresholds.", "archived_url": null } ], "notes": "Length and composition remain unknown because the source presents advice rather than requirements." }, { "id": "deezer", "name": "Deezer", "domain": "deezer.com", "sector": "streaming-media", "service_region": "Europe", "account_context": "Deezer consumer account.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The initial official-source pass did not locate an accessible page stating password rules or passkey availability." }, { "id": "crunchyroll", "name": "Crunchyroll", "domain": "crunchyroll.com", "sector": "streaming-media", "service_region": "North America", "account_context": "Crunchyroll consumer streaming account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "crunchyroll-getting-started", "type": "official_documentation", "url": "https://help.crunchyroll.com/hc/en-us/articles/22728708616852-Getting-started-on-Crunchyroll-website", "title": "Getting started on Crunchyroll website", "accessed_on": "2026-10-22", "paraphrase": "Crunchyroll documents account creation with an email address and password but does not state construction requirements on this page.", "archived_url": null } ], "notes": "Exact password rules and passkey availability remain unknown." }, { "id": "airbnb", "name": "Airbnb", "domain": "airbnb.com", "sector": "travel-mobility", "service_region": "North America", "account_context": "Airbnb guest or host account on a supported device; several social and regional sign-in methods are also available.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "airbnb-passkey", "type": "official_documentation", "url": "https://www.airbnb.com/help/article/4094", "title": "How passkeys work on Airbnb", "accessed_on": "2026-10-22", "paraphrase": "Airbnb documents optional passkey authentication for login and sensitive account actions on supported devices.", "archived_url": null } ], "notes": "The official help pages do not state exact enforced password construction rules." }, { "id": "booking", "name": "Booking.com", "domain": "booking.com", "sector": "travel-mobility", "service_region": "Europe", "account_context": "Booking.com consumer traveler account.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The initial official-source pass did not locate an accessible consumer help page stating password rules or passkey availability." }, { "id": "expedia", "name": "Expedia", "domain": "expedia.com", "sector": "travel-mobility", "service_region": "North America", "account_context": "US Expedia consumer traveler account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "expedia-contact-security", "type": "official_documentation", "url": "https://www.expedia.com/lp/b/getintouch", "title": "Get in touch with Expedia Customer Service", "accessed_on": "2026-10-22", "paraphrase": "Expedia's official fraud guidance confirms password and one-time-passcode account authentication but does not publish password construction rules.", "archived_url": null } ], "notes": "Exact password rules and passkey availability remain unknown." }, { "id": "tripadvisor", "name": "Tripadvisor", "domain": "tripadvisor.com", "sector": "travel-mobility", "service_region": "North America", "account_context": "Tripadvisor consumer traveler account.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The initial official-source pass did not locate an accessible page stating password requirements or passkey availability." }, { "id": "uber", "name": "Uber", "domain": "uber.com", "sector": "travel-mobility", "service_region": "North America", "account_context": "Uber rider account using the current mobile app on a supported device.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "uber-passkey", "type": "official_documentation", "url": "https://help.uber.com/riders/article/-?nodeId=61701cda-3615-43b2-8187-1440e91035d8", "title": "Using passkeys to sign in", "accessed_on": "2026-10-22", "paraphrase": "Uber documents optional passkey setup and sign-in for rider accounts on supported Android and Apple devices.", "archived_url": null } ], "notes": "Password construction rules remain unknown." }, { "id": "lyft", "name": "Lyft", "domain": "lyft.com", "sector": "travel-mobility", "service_region": "North America", "account_context": "Lyft rider account using the documented phone-number verification-code flow.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "not_applicable", "maximum_length": "not_applicable", "composition_rule": "not_applicable", "spaces_accepted": "not_applicable", "unicode_accepted": "not_applicable", "password_manager_allowed": "not_applicable", "autofill_allowed": "not_applicable", "paste_allowed": "not_applicable", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "lyft-account", "type": "official_documentation", "url": "https://help.lyft.com/hc/en-us/all/articles/115012926947-How-to-create-a-Lyft-account", "title": "How to create a Lyft account", "accessed_on": "2026-10-22", "paraphrase": "Lyft documents rider signup and identity verification using a phone number and texted verification code, without a password-creation step.", "archived_url": null } ], "notes": "This classification is limited to the current rider-account flow; driver or legacy accounts may differ." }, { "id": "doordash", "name": "DoorDash", "domain": "doordash.com", "sector": "travel-mobility", "service_region": "North America", "account_context": "US DoorDash consumer account; passkeys are currently limited to the iOS consumer app.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "doordash-password", "type": "official_documentation", "url": "https://help.doordash.com/en-us/consumers/article/received-a-password-reset-required-email-from-doordash", "title": "I received a password reset required email from DoorDash", "accessed_on": "2026-10-22", "paraphrase": "DoorDash says replacement passwords should be at least eight characters with upper- and lowercase letters, numbers, and symbols; it also documents password-manager use and iOS passkeys.", "archived_url": null } ], "notes": "DoorDash uses advisory wording for length and composition, so those fields remain unknown. Passkeys are rollout- and platform-limited." }, { "id": "deliveroo", "name": "Deliveroo", "domain": "deliveroo.com", "sector": "travel-mobility", "service_region": "Europe", "account_context": "Deliveroo consumer account.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The initial official-source pass did not locate an accessible consumer-account page stating password rules or passkey availability." }, { "id": "skyscanner", "name": "Skyscanner", "domain": "skyscanner.com", "sector": "travel-mobility", "service_region": "Europe", "account_context": "Skyscanner consumer account using current verification-code or federated sign-in options.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "not_applicable", "maximum_length": "not_applicable", "composition_rule": "not_applicable", "spaces_accepted": "not_applicable", "unicode_accepted": "not_applicable", "password_manager_allowed": "not_applicable", "autofill_allowed": "not_applicable", "paste_allowed": "not_applicable", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "skyscanner-passwordless", "type": "official_documentation", "url": "https://help.skyscanner.net/hc/en-us/articles/18191454525969-How-do-I-change-my-password", "title": "How do I change my password?", "accessed_on": "2026-10-22", "paraphrase": "Skyscanner states that accounts no longer use passwords and instead use federated sign-in or a four-digit emailed verification code.", "archived_url": null } ], "notes": "Password fields are not applicable to the documented current account flow." }, { "id": "agoda", "name": "Agoda", "domain": "agoda.com", "sector": "travel-mobility", "service_region": "Asia-Pacific", "account_context": "Agoda consumer traveler account using email or verified phone-number credentials.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "agoda-account", "type": "official_documentation", "url": "https://www.agoda.com/info/agoda-policies.html", "title": "Agoda policies", "accessed_on": "2026-10-22", "paraphrase": "Agoda documents creating and using an account password after phone-number verification but does not state construction rules on the accessible page.", "archived_url": null } ], "notes": "Exact password controls and passkey availability remain unknown." }, { "id": "google", "name": "Google", "domain": "google.com", "sector": "productivity-cloud", "service_region": "North America", "account_context": "Personal Google Account using a password as the sign-in method.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "no", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "google-password-help", "type": "official_documentation", "url": "https://support.google.com/accounts/answer/32040?hl=en-PW", "title": "Create a strong password & a more secure account", "accessed_on": "2026-10-22", "paraphrase": "Google says account passwords can use ASCII letters, numbers, and symbols, while accented characters are not supported; it also rejects particularly weak and previously used passwords.", "archived_url": null }, { "id": "google-passkeys", "type": "official_documentation", "url": "https://support.google.com/accounts/answer/13548313?hl=en", "title": "Sign in with a passkey instead of a password", "accessed_on": "2026-10-22", "paraphrase": "Google documents creating and using passkeys for personal Google Accounts.", "archived_url": null } ], "notes": "Google recommends at least 12 characters, but the accessible page presents that as advice rather than a field requirement, so no minimum is asserted." }, { "id": "microsoft", "name": "Microsoft", "domain": "microsoft.com", "sector": "productivity-cloud", "service_region": "North America", "account_context": "Personal Microsoft account; work and school accounts may be governed by an organization.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "microsoft-passkeys", "type": "official_documentation", "url": "https://support.microsoft.com/en-us/accounts-billing/security/create-save-passkey", "title": "Create and save a passkey", "accessed_on": "2026-10-22", "paraphrase": "Microsoft documents passkey sign-in for personal Microsoft accounts and work or school accounts, with device, password-manager, phone, and hardware-key storage options.", "archived_url": null } ], "notes": "No stable official personal-account page stating the enforced password construction rules was located during collection." }, { "id": "apple", "name": "Apple", "domain": "apple.com", "sector": "productivity-cloud", "service_region": "North America", "account_context": "Personal Apple Account password.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": "unknown", "composition_rule": "yes", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "yes", "passkey_available": "unknown" }, "evidence": [ { "id": "apple-security", "type": "official_documentation", "url": "https://support.apple.com/en-ca/guide/security/secbd5822138/web", "title": "Apple Account security overview", "accessed_on": "2026-10-22", "paraphrase": "Apple states that an Apple Account password must have at least eight characters, include letters and numbers, avoid three or more identical consecutive characters, and not be a commonly used password.", "archived_url": null } ], "notes": "The screening field records Apple's disclosed rejection of commonly used passwords; the page does not describe the underlying blocklist." }, { "id": "dropbox", "name": "Dropbox", "domain": "dropbox.com", "sector": "productivity-cloud", "service_region": "North America", "account_context": "Dropbox Basic or eligible paid personal account; team availability can depend on administrator settings.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "dropbox-passkeys", "type": "official_documentation", "url": "https://help.dropbox.com/account-access/passkey-log-in", "title": "How to use a passkey to log in to your account", "accessed_on": "2026-10-22", "paraphrase": "Dropbox documents passkey login for Basic, Plus, Professional, Essentials, Family, and some team plans, with administrator enablement required for some teams.", "archived_url": null } ], "notes": "Password construction rules remain unknown from the accessible official documentation." }, { "id": "box", "name": "Box", "domain": "box.com", "sector": "productivity-cloud", "service_region": "North America", "account_context": "Box managed-user account; password settings can be chosen by the organization administrator.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "box-password-policy", "type": "official_documentation", "url": "https://support.box.com/hc/en-us/articles/360044193273-Best-Practice-Choosing-Security-Settings", "title": "Best Practice - Choosing Security Settings", "accessed_on": "2026-10-22", "paraphrase": "Box documents administrator-configurable password length, complexity, expiration, and reuse controls for managed users, so one fixed consumer rule set cannot be assigned.", "archived_url": null } ], "notes": "Controls are left unknown because values vary by organization." }, { "id": "zoom", "name": "Zoom", "domain": "zoom.us", "sector": "productivity-cloud", "service_region": "North America", "account_context": "Zoom account using an email address and Zoom-managed password, not federated sign-in.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": 99, "composition_rule": "yes", "spaces_accepted": "no", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "zoom-passwords", "type": "official_documentation", "url": "https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0061483", "title": "Zoom password requirements", "accessed_on": "2026-10-22", "paraphrase": "Zoom lists an 8-to-99-character range, upper- and lowercase letters, at least one number, no spaces, and restrictions on repeated or consecutive characters for Zoom-managed passwords.", "archived_url": null }, { "id": "zoom-passkeys", "type": "official_documentation", "url": "https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0083521", "title": "Managing and signing in to Zoom with a Passkey", "accessed_on": "2026-10-22", "paraphrase": "Zoom documents passkey setup and sign-in for eligible personal and managed accounts.", "archived_url": null } ], "notes": "The password rules do not apply to Google, Apple, Facebook, or SSO credentials. Passkey availability can be controlled by an account administrator." }, { "id": "slack", "name": "Slack", "domain": "slack.com", "sector": "productivity-cloud", "service_region": "North America", "account_context": "Current Slack workspace sign-in using an email address; SSO requirements may vary by workspace.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "slack-signin", "type": "official_documentation", "url": "https://slack.com/help/articles/212681477-Sign-in-to-Slack", "title": "Sign in to Slack", "accessed_on": "2026-10-22", "paraphrase": "Slack documents email sign-in using a passkey, an emailed confirmation code, or workspace SSO, and provides account settings for adding passkeys.", "archived_url": null } ], "notes": "The page does not establish universal password-field rules across current and legacy workspace configurations." }, { "id": "notion", "name": "Notion", "domain": "notion.so", "sector": "productivity-cloud", "service_region": "North America", "account_context": "Notion account with an optional permanent password rather than temporary login codes or SSO.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": "unknown", "composition_rule": "yes", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "notion-account", "type": "official_documentation", "url": "https://www.notion.com/en-gb/help/account-settings", "title": "Notion account settings & preferences", "accessed_on": "2026-10-22", "paraphrase": "Notion requires at least eight characters and four unique characters; passwords 8–14 characters long need at least one letter and one number, while that composition rule is removed at 15 characters.", "archived_url": null }, { "id": "notion-passkeys", "type": "official_documentation", "url": "https://www.notion.com/en-gb/help/passkeys", "title": "Passkeys", "accessed_on": "2026-10-22", "paraphrase": "Notion documents passkey login for accounts with or without a password, except where an organization requires identity-provider login.", "archived_url": null } ], "notes": "Composition is conditional on length; special characters are allowed but not required." }, { "id": "canva", "name": "Canva", "domain": "canva.com", "sector": "productivity-cloud", "service_region": "Asia-Pacific", "account_context": "Canva consumer account with an optional password; social and emailed-code sign-in are also available.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "yes", "passkey_available": "yes" }, "evidence": [ { "id": "canva-security", "type": "official_documentation", "url": "https://www.canva.com/help/protect-account/", "title": "Protect your account", "accessed_on": "2026-10-22", "paraphrase": "Canva recommends password managers and says it checks passwords against known data breaches, rejecting passwords exposed in a third-party breach.", "archived_url": null }, { "id": "canva-login", "type": "official_documentation", "url": "https://www.canva.com/en_in/help/sign-up-log-in-variantb/", "title": "Creating and logging in to your Canva account", "accessed_on": "2026-10-22", "paraphrase": "Canva documents emailed-code signup, optional password setup, and an optional passkey setup prompt in a current regional login flow.", "archived_url": null } ], "notes": "Canva describes eight characters as a recommendation, not an enforced minimum, so the minimum remains unknown. Passkey rollout may vary by region and flow." }, { "id": "adobe", "name": "Adobe", "domain": "adobe.com", "sector": "productivity-cloud", "service_region": "North America", "account_context": "Personal Adobe account using Adobe-managed credentials.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "adobe-passkeys", "type": "official_documentation", "url": "https://helpx.adobe.com/account/individual/sign-in-and-security/sign-in-methods/passkeys-overview.html", "title": "Passkeys overview", "accessed_on": "2026-10-22", "paraphrase": "Adobe documents passkeys for personal Adobe accounts and lists supported operating systems, devices, password managers, and FIDO2 security keys.", "archived_url": null } ], "notes": "Accessible Adobe account pages documented password setup and reset but did not state construction rules, so those controls remain unknown." }, { "id": "github", "name": "GitHub", "domain": "github.com", "sector": "developer-services", "service_region": "North America", "account_context": "GitHub.com personal account password used in the browser.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": "unknown", "composition_rule": "yes", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "yes", "passkey_available": "yes" }, "evidence": [ { "id": "github-password", "type": "official_documentation", "url": "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-strong-password", "title": "Creating a strong password", "accessed_on": "2026-10-22", "paraphrase": "GitHub requires eight characters when the password includes a number and lowercase letter, or 15 characters with any character combination; it recommends password managers and checks passwords against weak-password datasets including Have I Been Pwned.", "archived_url": null }, { "id": "github-passkey", "type": "official_documentation", "url": "https://docs.github.com/en/authentication/authenticating-with-a-passkey", "title": "Authenticating with a passkey", "accessed_on": "2026-10-22", "paraphrase": "GitHub documents passkeys for browser sign-in without a password and separate two-factor step.", "archived_url": null } ], "notes": "The minimum is conditional: passwords without the stated number-and-lowercase combination must be at least 15 characters." }, { "id": "gitlab", "name": "GitLab", "domain": "gitlab.com", "sector": "developer-services", "service_region": "North America", "account_context": "GitLab.com user account; self-managed instances can set different policies.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": 128, "composition_rule": "no", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "gitlab-password", "type": "official_documentation", "url": "https://docs.gitlab.com/user/gitlab_com/", "title": "GitLab.com settings", "accessed_on": "2026-10-22", "paraphrase": "GitLab.com states that passwords must be 8–128 characters and that all characters are accepted, without requiring a mix of character classes.", "archived_url": null }, { "id": "gitlab-passkey", "type": "official_documentation", "url": "https://docs.gitlab.com/auth/passkeys/", "title": "Passkeys", "accessed_on": "2026-10-22", "paraphrase": "GitLab documents passkey sign-in on GitLab.com, subject to group or instance settings.", "archived_url": null } ], "notes": "The character statement does not explicitly resolve spaces or the full Unicode range, so those fields remain unknown." }, { "id": "bitbucket", "name": "Bitbucket", "domain": "bitbucket.org", "sector": "developer-services", "service_region": "Asia-Pacific", "account_context": "Bitbucket Cloud using a non-managed Atlassian account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "yes", "passkey_available": "yes" }, "evidence": [ { "id": "atlassian-security", "type": "official_documentation", "url": "https://support.atlassian.com/atlassian-account/docs/protect-your-atlassian-account", "title": "Protect your Atlassian account", "accessed_on": "2026-10-22", "paraphrase": "Atlassian recommends password managers and says it detects credentials associated with third-party breaches, invalidating a matched account password.", "archived_url": null }, { "id": "atlassian-passkey", "type": "official_documentation", "url": "https://support.atlassian.com/atlassian-account/docs/access-your-atlassian-account-with-a-passkey/", "title": "Access your Atlassian account with a passkey", "accessed_on": "2026-10-22", "paraphrase": "Atlassian documents passwordless passkey sign-in for non-managed accounts used with Bitbucket Cloud.", "archived_url": null } ], "notes": "Managed Atlassian accounts may have organization-controlled sign-in. Exact password construction rules remain unknown." }, { "id": "stack-overflow", "name": "Stack Overflow", "domain": "stackoverflow.com", "sector": "developer-services", "service_region": "North America", "account_context": "Stack Overflow consumer account created with an email address and password.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "stackoverflow-account", "type": "official_documentation", "url": "https://stackoverflow.com/legal/privacy-policy", "title": "Privacy Policy", "accessed_on": "2026-10-22", "paraphrase": "Stack Overflow identifies email, username, and password as information required for a password-based account but does not state construction rules on the accessible policy page.", "archived_url": null } ], "notes": "Password controls and passkey availability remain unknown." }, { "id": "npm", "name": "npm", "domain": "npmjs.com", "sector": "developer-services", "service_region": "North America", "account_context": "Individual npmjs.com public-registry account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 11, "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "yes", "passkey_available": "unknown" }, "evidence": [ { "id": "npm-password", "type": "official_documentation", "url": "https://docs.npmjs.com/creating-a-strong-password/", "title": "Creating a strong password", "accessed_on": "2026-10-22", "paraphrase": "npm requires a password longer than 10 characters, disallows substantial username overlap, checks against Have I Been Pwned, and recommends using a password manager.", "archived_url": null } ], "notes": "The documented wording is 'longer than 10 characters,' recorded as a minimum accepted length of 11." }, { "id": "docker-hub", "name": "Docker Hub", "domain": "docker.com", "sector": "developer-services", "service_region": "North America", "account_context": "Individual Docker account used for Docker Home or Docker Hub browser sign-in.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "docker-auth", "type": "official_documentation", "url": "https://docs.docker.com/security/authentication/2fa/", "title": "Two-factor authentication for your individual Docker account", "accessed_on": "2026-10-22", "paraphrase": "Docker documents password-based browser sign-in and notes that command-line sign-in uses a personal access token when two-factor authentication is enabled.", "archived_url": null } ], "notes": "The accessible official page establishes the account context but not password construction rules or passkey sign-in." }, { "id": "digitalocean", "name": "DigitalOcean", "domain": "digitalocean.com", "sector": "developer-services", "service_region": "North America", "account_context": "DigitalOcean personal account using email and password rather than Google or GitHub SSO.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "digitalocean-settings", "type": "official_documentation", "url": "https://docs.digitalocean.com/platform/accounts/settings/", "title": "How to Manage DigitalOcean Personal Account Settings", "accessed_on": "2026-10-22", "paraphrase": "DigitalOcean documents email-and-password login, password reset, and alternative Google or GitHub sign-in without stating password construction rules.", "archived_url": null } ], "notes": "Password controls and passkey availability remain unknown." }, { "id": "cloudflare", "name": "Cloudflare", "domain": "cloudflare.com", "sector": "developer-services", "service_region": "North America", "account_context": "Cloudflare dashboard user account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "cloudflare-account", "type": "official_documentation", "url": "https://developers.cloudflare.com/fundamentals/account/create-account/", "title": "Create account", "accessed_on": "2026-10-22", "paraphrase": "Cloudflare documents account creation with an email address and password but does not state password construction rules on the accessible page.", "archived_url": null }, { "id": "cloudflare-2fa", "type": "official_documentation", "url": "https://developers.cloudflare.com/fundamentals/user-profiles/2fa/", "title": "Two-factor authentication", "accessed_on": "2026-10-22", "paraphrase": "Cloudflare documents WebAuthn security keys as a second factor, not as passwordless passkey sign-in.", "archived_url": null } ], "notes": "A WebAuthn second factor is not counted as passkey sign-in. Password controls remain unknown." }, { "id": "vercel", "name": "Vercel", "domain": "vercel.com", "sector": "developer-services", "service_region": "North America", "account_context": "Current Vercel personal account using email authentication, a Git provider, or a passkey.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "not_applicable", "maximum_length": "not_applicable", "composition_rule": "not_applicable", "spaces_accepted": "not_applicable", "unicode_accepted": "not_applicable", "password_manager_allowed": "not_applicable", "autofill_allowed": "not_applicable", "paste_allowed": "not_applicable", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "vercel-account", "type": "official_documentation", "url": "https://vercel.com/docs/accounts", "title": "Account Management", "accessed_on": "2026-10-22", "paraphrase": "Vercel documents email signup and login with a six-digit one-time password, Git-provider connections, and passwordless passkey login.", "archived_url": null } ], "notes": "Password-field controls are not applicable to the documented current Vercel-managed email flow." }, { "id": "netlify", "name": "Netlify", "domain": "netlify.com", "sector": "developer-services", "service_region": "North America", "account_context": "Netlify user account using a Netlify-managed password.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 10, "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "netlify-settings", "type": "official_documentation", "url": "https://docs.netlify.com/accounts-and-billing/user-settings/", "title": "User settings", "accessed_on": "2026-10-22", "paraphrase": "Netlify states that the password used to log in must be at least 10 characters.", "archived_url": null } ], "notes": "Other password controls and passkey availability remain unknown." }, { "id": "steam", "name": "Steam", "domain": "steampowered.com", "sector": "gaming", "service_region": "North America", "account_context": "Steam consumer account password.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 6, "maximum_length": "unknown", "composition_rule": "yes", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "steam-security", "type": "official_documentation", "url": "https://help.steampowered.com/en/faqs/view/6639-EB3C-EC79-FF60", "title": "Account Security Recommendations", "accessed_on": "2026-10-22", "paraphrase": "Steam lists a minimum of six characters, upper- and lowercase letters, and at least one number among its password minimum requirements.", "archived_url": null } ], "notes": "Steam also advises against names, dictionary words, and keyboard sequences." }, { "id": "epic-games", "name": "Epic Games", "domain": "epicgames.com", "sector": "gaming", "service_region": "North America", "account_context": "Epic Games consumer account using an Epic-managed password.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": "unknown", "composition_rule": "yes", "spaces_accepted": "no", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "epic-reset", "type": "official_documentation", "url": "https://www.epicgames.com/help/en-US/c-Category_EpicAccount/c-EpicAccountServices/a000084798?lang=en-US", "title": "How to reset your Epic Games password", "accessed_on": "2026-10-22", "paraphrase": "Epic requires more than seven characters, at least one number and one letter, no spaces, and a password different from the previous five.", "archived_url": null }, { "id": "epic-security", "type": "official_documentation", "url": "https://www.epicgames.com/help/c-34254770/c-5719365892123/a24989601?lang=en-US", "title": "Securing your Epic Games account", "accessed_on": "2026-10-22", "paraphrase": "Epic recommends using a password manager to generate and store a unique password.", "archived_url": null } ], "notes": "Epic documents password history in addition to the measured controls." }, { "id": "xbox", "name": "Xbox", "domain": "xbox.com", "sector": "gaming", "service_region": "North America", "account_context": "Xbox profile signed in through a personal Microsoft account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "xbox-microsoft-passkey", "type": "official_documentation", "url": "https://support.microsoft.com/en-us/accounts-billing/security/create-save-passkey", "title": "Create and save a passkey", "accessed_on": "2026-10-22", "paraphrase": "Microsoft documents passkeys for the personal Microsoft account used to sign in to Xbox services.", "archived_url": null } ], "notes": "The credential policy belongs to the underlying Microsoft account; exact password construction rules remain unknown." }, { "id": "playstation", "name": "PlayStation", "domain": "playstation.com", "sector": "gaming", "service_region": "Asia-Pacific", "account_context": "Personal account for PlayStation using password or passkey sign-in.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "yes", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "playstation-account", "type": "official_documentation", "url": "https://www.playstation.com/en-us/support/account/", "title": "Account & Security", "accessed_on": "2026-10-22", "paraphrase": "PlayStation documents passkey setup and requires a mix of upper- and lowercase letters, numbers, and special characters when recovering an account with a new password.", "archived_url": null }, { "id": "playstation-security", "type": "official_documentation", "url": "https://www.playstation.com/en-us/support/account/security-best-practice/", "title": "How to use security best practices on PlayStation", "accessed_on": "2026-10-22", "paraphrase": "PlayStation recommends using either a password manager or a passkey.", "archived_url": null } ], "notes": "The accessible page does not state a numeric minimum or maximum length." }, { "id": "nintendo", "name": "Nintendo", "domain": "nintendo.com", "sector": "gaming", "service_region": "Asia-Pacific", "account_context": "Personal Nintendo Account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": 20, "composition_rule": "yes", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "yes", "passkey_available": "yes" }, "evidence": [ { "id": "nintendo-password", "type": "official_documentation", "url": "https://en-americas-support.nintendo.com/app/answers/detail/a_id/15994/p/989", "title": "Unable to Create a Nintendo Account Password", "accessed_on": "2026-10-22", "paraphrase": "Nintendo requires 8–20 characters, at least two of three character categories, and no character repeated more than twice; it also discloses rejecting passwords judged insecure using external information.", "archived_url": null }, { "id": "nintendo-passkey", "type": "official_documentation", "url": "https://en-americas-support.nintendo.com/app/answers/detail/a_id/62531/~/how-to-manage-passkey-authentication-for-a-nintendo-account", "title": "How to Manage Passkey Authentication for a Nintendo Account", "accessed_on": "2026-10-22", "paraphrase": "Nintendo documents registering and using up to ten passkeys for Nintendo Account sign-in.", "archived_url": null } ], "notes": "The screening disclosure does not identify the external source or full rejection criteria." }, { "id": "roblox", "name": "Roblox", "domain": "roblox.com", "sector": "gaming", "service_region": "North America", "account_context": "Roblox consumer account with password or passkey login.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "yes", "passkey_available": "yes" }, "evidence": [ { "id": "roblox-screening", "type": "official_documentation", "url": "https://en.help.roblox.com/hc/en-us/articles/4416940180500-Why-am-I-seeing-a-banner-asking-me-to-change-my-password", "title": "Why am I seeing a banner asking me to change my password?", "accessed_on": "2026-10-22", "paraphrase": "Roblox says it may require a password change when it detects that a password might have been stolen from other services and recommends a password manager.", "archived_url": null }, { "id": "roblox-passkey", "type": "official_documentation", "url": "https://en.help.roblox.com/hc/en-us/articles/20669991483156-Logging-in-with-a-Passkey", "title": "Logging in with a Passkey", "accessed_on": "2026-10-22", "paraphrase": "Roblox documents passkey login on supported mobile devices and web browsers.", "archived_url": null } ], "notes": "Numeric password construction rules were not established from accessible official pages." }, { "id": "ea", "name": "EA", "domain": "ea.com", "sector": "gaming", "service_region": "North America", "account_context": "Personal EA Account using an EA-managed password.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "ea-security", "type": "official_documentation", "url": "https://help.ea.com/en//articles/security-and-rules/secure-your-ea-account/", "title": "How to keep your EA Account secure", "accessed_on": "2026-10-22", "paraphrase": "EA tells users to use 8–16 characters, upper- and lowercase letters, and a combination of letters, numbers, and special characters.", "archived_url": null }, { "id": "ea-recovery", "type": "official_documentation", "url": "https://help.ea.com/en/articles/ea-account/locked-out-of-ea-account/", "title": "Get back into your EA Account", "accessed_on": "2026-10-22", "paraphrase": "EA documents passkeys as an account sign-in and recovery method alongside passwords and linked accounts.", "archived_url": null } ], "notes": "EA phrases the construction list as security guidance, so length and composition remain unknown." }, { "id": "ubisoft", "name": "Ubisoft", "domain": "ubisoft.com", "sector": "gaming", "service_region": "Europe", "account_context": "Personal Ubisoft account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "ubisoft-security", "type": "official_documentation", "url": "https://www.ubisoft.com/en-us/help?isSso=true", "title": "Ubisoft Help - Official Account & Game Support", "accessed_on": "2026-10-22", "paraphrase": "Ubisoft advises at least eight characters with upper- and lowercase letters, a number, and a special character, and recommends regular password updates.", "archived_url": null } ], "notes": "The accessible help text uses advisory wording, so length, composition, and periodic-change controls remain unknown." }, { "id": "riot-games", "name": "Riot Games", "domain": "riotgames.com", "sector": "gaming", "service_region": "North America", "account_context": "Full Riot Account using Riot-managed username and password; social and some mobile guest sign-ins differ.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "yes", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "riot-security", "type": "official_documentation", "url": "https://support.riotgames.com/en-us/riot/account/protecting-your-account", "title": "Protecting Your Account", "accessed_on": "2026-10-22", "paraphrase": "Riot recommends password managers and long random passwords but does not state enforced length or composition rules on the accessible account-security page.", "archived_url": null } ], "notes": "Exact password controls and passkey availability remain unknown." }, { "id": "battle-net", "name": "Battle.net", "domain": "battle.net", "sector": "gaming", "service_region": "North America", "account_context": "Personal Battle.net account.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The initial official-source pass did not locate an accessible current page stating account password rules or passwordless passkey availability." }, { "id": "coursera", "name": "Coursera", "domain": "coursera.org", "sector": "education-knowledge", "service_region": "North America", "account_context": "Personal Coursera learner account using Coursera-managed email and password login.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "coursera-login", "type": "official_documentation", "url": "https://www.coursera.support/s/article/learner-000002204?language=en_US", "title": "Update your login settings", "accessed_on": "2026-10-22", "paraphrase": "Coursera documents password change and reset, federated login, organization SSO, and optional two-factor authentication without stating password construction rules.", "archived_url": null } ], "notes": "Password controls and passkey availability remain unknown." }, { "id": "udemy", "name": "Udemy", "domain": "udemy.com", "sector": "education-knowledge", "service_region": "North America", "account_context": "Current Udemy consumer login using emailed or texted verification codes.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "not_applicable", "maximum_length": "not_applicable", "composition_rule": "not_applicable", "spaces_accepted": "not_applicable", "unicode_accepted": "not_applicable", "password_manager_allowed": "not_applicable", "autofill_allowed": "not_applicable", "paste_allowed": "not_applicable", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "udemy-security", "type": "official_documentation", "url": "https://support.udemy.com/hc/en-us/sections/4411129698327-Account-security?type=student", "title": "Account security", "accessed_on": "2026-10-22", "paraphrase": "Udemy says passwordless email authentication with a six-digit code is the default login method and cannot be disabled; legacy passwords may remain for sensitive account tasks.", "archived_url": null } ], "notes": "Password-field controls are not applicable to the current login flow, even though some legacy accounts retain passwords for account changes." }, { "id": "khan-academy", "name": "Khan Academy", "domain": "khanacademy.org", "sector": "education-knowledge", "service_region": "North America", "account_context": "Khan Academy account using an email address and Khan Academy-managed password rather than federated sign-in.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "khan-reset", "type": "official_documentation", "url": "https://support.khanacademy.org/hc/en-us/articles/202487480-How-do-I-reset-my-password", "title": "How do I reset my password?", "accessed_on": "2026-10-22", "paraphrase": "Khan Academy documents password reset for native accounts and delegates password changes to Google, Facebook, Clever, ClassLink, Apple, or Microsoft for federated accounts.", "archived_url": null } ], "notes": "The accessible page does not state password construction rules or passkey availability." }, { "id": "duolingo", "name": "Duolingo", "domain": "duolingo.com", "sector": "education-knowledge", "service_region": "North America", "account_context": "Duolingo consumer account.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The initial official-source pass did not locate an accessible current help page stating password rules or passkey availability." }, { "id": "quizlet", "name": "Quizlet", "domain": "quizlet.com", "sector": "education-knowledge", "service_region": "North America", "account_context": "Quizlet consumer account with a password added to an email or federated account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "quizlet-login", "type": "official_documentation", "url": "https://help.quizlet.com/hc/en-us/articles/360032346311-Trouble-logging-in", "title": "Trouble logging in", "accessed_on": "2026-10-22", "paraphrase": "Quizlet documents adding a password after email-link or Google login, but the accessible page does not state construction rules.", "archived_url": null } ], "notes": "Password controls and passkey availability remain unknown." }, { "id": "edx", "name": "edX", "domain": "edx.org", "sector": "education-knowledge", "service_region": "North America", "account_context": "Personal edX learner account using an edX-managed password.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "edx-login", "type": "official_documentation", "url": "https://support.edx.org/hc/en-us/articles/206914987-What-if-I-am-having-login-problems-or-forgot-my-password", "title": "What if I am having login problems or forgot my password?", "accessed_on": "2026-10-22", "paraphrase": "edX documents email-and-password login and password reset without stating password construction rules.", "archived_url": null } ], "notes": "Password controls and passkey availability remain unknown." }, { "id": "chegg", "name": "Chegg", "domain": "chegg.com", "sector": "education-knowledge", "service_region": "North America", "account_context": "Chegg consumer account.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The initial official-source pass did not locate an accessible current Chegg page stating account password rules or passkey availability." }, { "id": "wikipedia", "name": "Wikipedia", "domain": "wikipedia.org", "sector": "education-knowledge", "service_region": "Global", "account_context": "Standard Wikimedia account used on Wikipedia; privileged accounts have a higher minimum.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": "unknown", "composition_rule": "no", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "yes", "passkey_available": "yes" }, "evidence": [ { "id": "wikimedia-policy", "type": "official_documentation", "url": "https://www.mediawiki.org/wiki/Wikimedia_Security_Team/Password_strengthening_2019", "title": "Wikimedia Security Team/Password strengthening 2019", "accessed_on": "2026-10-22", "paraphrase": "Wikimedia states an eight-character minimum for ordinary accounts, rejects the 100,000 most popular passwords and passwords matching the username, and does not require character-class composition.", "archived_url": null }, { "id": "wikimedia-passkeys", "type": "official_documentation", "url": "https://www.mediawiki.org/wiki/Product_Safety_and_Integrity/Account_Security", "title": "Product Safety and Integrity/Account Security", "accessed_on": "2026-10-22", "paraphrase": "Wikimedia documents passwordless passkey login added in March 2026 for users who first configure another two-factor method.", "archived_url": null } ], "notes": "Privileged Wikimedia accounts have a ten-character minimum; this record describes a standard account." }, { "id": "researchgate", "name": "ResearchGate", "domain": "researchgate.net", "sector": "education-knowledge", "service_region": "Europe", "account_context": "ResearchGate member account using institutional email and password.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "researchgate-signup", "type": "official_documentation", "url": "https://help.researchgate.net/getting-started/signing-up-for-researchgate", "title": "Signing up for ResearchGate", "accessed_on": "2026-10-22", "paraphrase": "ResearchGate documents signup with an institutional email address and password but does not state construction rules on the accessible page.", "archived_url": null } ], "notes": "Password controls and passkey availability remain unknown." }, { "id": "academia", "name": "Academia.edu", "domain": "academia.edu", "sector": "education-knowledge", "service_region": "North America", "account_context": "Academia.edu account using email and password rather than Google or Apple login.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "academia-password", "type": "official_documentation", "url": "https://support.academia.edu/hc/en-us/articles/360042888234-How-to-update-the-password-in-your-settings", "title": "How to update the password in your settings", "accessed_on": "2026-10-22", "paraphrase": "Academia.edu documents setting and changing an account password without stating construction rules.", "archived_url": null } ], "notes": "Password controls and passkey availability remain unknown." }, { "id": "myfitnesspal", "name": "MyFitnessPal", "domain": "myfitnesspal.com", "sector": "health-fitness", "service_region": "North America", "account_context": "Current MyFitnessPal consumer account using email and password.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "myfitnesspal-reset", "type": "official_documentation", "url": "https://support.myfitnesspal.com/hc/en-us/articles/360032273512-How-to-retrieve-a-forgotten-password-or-username", "title": "How to retrieve a forgotten password or username", "accessed_on": "2026-10-22", "paraphrase": "MyFitnessPal says a new password should be at least 10 characters long and should be unique and complex.", "archived_url": null } ], "notes": "The page says a new password 'should be' at least 10 characters, so length remains unknown rather than being treated as an enforced field rule." }, { "id": "strava", "name": "Strava", "domain": "strava.com", "sector": "health-fitness", "service_region": "North America", "account_context": "Strava consumer account using email and password; one-time-code login is also available.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "strava-login", "type": "official_documentation", "url": "https://support.strava.com/en-us/articles/15401976-forgot-your-password", "title": "Forgot your password?", "accessed_on": "2026-10-22", "paraphrase": "Strava documents password recovery, password change, and optional one-time-code login without stating password construction rules.", "archived_url": null } ], "notes": "Password controls and passkey availability remain unknown." }, { "id": "headspace", "name": "Headspace", "domain": "headspace.com", "sector": "health-fitness", "service_region": "North America", "account_context": "Headspace consumer account.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The initial official-source pass did not locate an accessible current help page stating account password rules or passkey availability." }, { "id": "calm", "name": "Calm", "domain": "calm.com", "sector": "health-fitness", "service_region": "North America", "account_context": "Calm consumer account using email and password rather than Facebook, Apple, or Google sign-in.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "calm-login", "type": "official_documentation", "url": "https://support.calm.com/hc/en-us/articles/10478569703963-How-to-Log-In-and-Log-Out-of-Your-Calm-Account", "title": "How to Log In and Log Out of Your Calm Account", "accessed_on": "2026-10-22", "paraphrase": "Calm documents email-and-password login alongside Facebook, Apple, and Google sign-in but does not state construction rules on the current page.", "archived_url": null } ], "notes": "An older localized article stated an eight-character minimum, but it was not used because a current English source did not confirm the rule." }, { "id": "fitbit", "name": "Fitbit", "domain": "fitbit.com", "sector": "health-fitness", "service_region": "North America", "account_context": "Fitbit service for a new user, which now requires a personal Google Account.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "no", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "yes" }, "evidence": [ { "id": "fitbit-google", "type": "official_documentation", "url": "https://support.google.com/product-documentation/answer/14226283?hl=en-419", "title": "Fitbit setup requirements", "accessed_on": "2026-10-22", "paraphrase": "Fitbit states that new users require a Google Account and that legacy Fitbit accounts ceased being the standard login path in 2026.", "archived_url": null }, { "id": "fitbit-google-password", "type": "official_documentation", "url": "https://support.google.com/accounts/answer/32040?hl=en-PW", "title": "Create a strong password & a more secure account", "accessed_on": "2026-10-22", "paraphrase": "Google says Google Account passwords support ASCII characters but not accented characters.", "archived_url": null }, { "id": "fitbit-google-passkey", "type": "official_documentation", "url": "https://support.google.com/accounts/answer/13548313?hl=en", "title": "Sign in with a passkey instead of a password", "accessed_on": "2026-10-22", "paraphrase": "Google documents passkeys for the Google Account used by new Fitbit users.", "archived_url": null } ], "notes": "This observation measures the required Google Account for new users, not a legacy Fitbit credential." }, { "id": "flo-health", "name": "Flo Health", "domain": "flo.health", "sector": "health-fitness", "service_region": "Europe", "account_context": "Flo consumer account registered with email rather than Google or Apple.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "flo-account", "type": "official_documentation", "url": "https://help.flo.health/hc/en-us/articles/4406826484500-Setting-up-your-Flo-account", "title": "Setting up your Flo account", "accessed_on": "2026-10-22", "paraphrase": "Flo documents password creation for email registration and federated Google or Apple alternatives without stating password construction rules.", "archived_url": null } ], "notes": "Password controls and passkey availability remain unknown." }, { "id": "doctolib", "name": "Doctolib", "domain": "doctolib.com", "sector": "health-fitness", "service_region": "Europe", "account_context": "Doctolib patient account, excluding the separate Doctolib Connect professional product.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The official-source pass found documentation for the separate Doctolib Connect professional product but did not locate an accessible patient-account page stating password rules or passkey availability." }, { "id": "practo", "name": "Practo", "domain": "practo.com", "sector": "health-fitness", "service_region": "Asia-Pacific", "account_context": "Practo consumer patient account, excluding the separate Practo Ray professional product.", "observed_at": "2026-10-22", "collection_method": "not_testable", "review_status": "not_testable", "controls": { "minimum_length": "unknown", "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [], "notes": "The official-source pass found professional-account guidance but did not locate an accessible consumer patient-account page stating password rules or passkey availability." }, { "id": "zocdoc", "name": "Zocdoc", "domain": "zocdoc.com", "sector": "health-fitness", "service_region": "North America", "account_context": "Current Zocdoc patient login using an emailed or texted verification code or federated Google or Apple sign-in.", "observed_at": "2026-10-22", "collection_method": "official_documentation", "review_status": "reviewed", "controls": { "minimum_length": "not_applicable", "maximum_length": "not_applicable", "composition_rule": "not_applicable", "spaces_accepted": "not_applicable", "unicode_accepted": "not_applicable", "password_manager_allowed": "not_applicable", "autofill_allowed": "not_applicable", "paste_allowed": "not_applicable", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "zocdoc-login", "type": "official_documentation", "url": "https://www.zocdoc.com/patient-help/en/articles/8839064-how-do-i-log-in-to-zocdoc", "title": "How do I log in to Zocdoc?", "accessed_on": "2026-10-22", "paraphrase": "Zocdoc's current patient login sends a six-digit code by phone or email and also supports Google or Apple sign-in.", "archived_url": null } ], "notes": "Password-field controls are not applicable to the documented current patient login; provider and legacy accounts differ." }, { "id": "healthifyme", "name": "HealthifyMe", "domain": "healthifyme.com", "sector": "health-fitness", "service_region": "Asia-Pacific", "account_context": "HealthifyMe consumer account using the public web signup form.", "observed_at": "2026-10-22", "collection_method": "public_interface", "review_status": "reviewed", "controls": { "minimum_length": 8, "maximum_length": "unknown", "composition_rule": "unknown", "spaces_accepted": "unknown", "unicode_accepted": "unknown", "password_manager_allowed": "unknown", "autofill_allowed": "unknown", "paste_allowed": "unknown", "periodic_change_required": "unknown", "compromised_password_screening_disclosed": "unknown", "passkey_available": "unknown" }, "evidence": [ { "id": "healthifyme-signup", "type": "public_interface", "url": "https://www.healthifyme.com/new", "title": "HealthifyMe signup and login", "accessed_on": "2026-10-22", "paraphrase": "The public signup form labels the password field with a minimum of eight characters.", "archived_url": null } ], "notes": "No form was submitted and no account was created. Other controls and passkey availability remain unknown." } ] }