# Data dictionary

Every field describes one account context at one service on one observation
date. A service with materially different consumer and business policies may
require a later, separately identified observation.

| Field | Allowed value | Meaning |
| --- | --- | --- |
| `minimum_length` | positive integer, `unknown`, `not_applicable` | Smallest accepted password length established by evidence. Do not substitute a recommendation for an enforced minimum. |
| `maximum_length` | positive integer, `unknown`, `not_applicable` | Largest accepted password length established by evidence. “At least 64” is not evidence of the exact maximum. |
| `composition_rule` | `yes`, `no`, `unknown`, `not_applicable` | Whether the service requires a mixture of character classes or a comparable construction rule. Advice alone is not a requirement. |
| `spaces_accepted` | `yes`, `no`, `unknown`, `not_applicable` | Whether the password accepts the ASCII space character. |
| `unicode_accepted` | `yes`, `no`, `unknown`, `not_applicable` | Whether non-ASCII Unicode characters are accepted. Do not infer this from a field lacking an HTML pattern. |
| `password_manager_allowed` | `yes`, `no`, `unknown`, `not_applicable` | Whether official documentation or safe public observation establishes password-manager use is allowed. |
| `autofill_allowed` | `yes`, `no`, `unknown`, `not_applicable` | Whether password autofill is supported. A browser suggestion appearing is not sufficient if the service overrides submission. |
| `paste_allowed` | `yes`, `no`, `unknown`, `not_applicable` | Whether pasted password input is supported. No real password may be used to test this. |
| `periodic_change_required` | `yes`, `no`, `unknown`, `not_applicable` | Whether routine password changes are required without evidence of compromise. Advice to change occasionally is not necessarily an enforced requirement. |
| `compromised_password_screening_disclosed` | `yes`, `no`, `unknown`, `not_applicable` | Whether the service publicly states that prospective passwords are checked against compromised or commonly used values. `no` requires evidence that screening is not performed; silence is `unknown`. |
| `passkey_available` | `yes`, `no`, `unknown`, `not_applicable` | Whether the sampled account context supports passkey authentication. Record regional, device, or account restrictions in notes. |

## Evidence types

- `official_documentation`: a page published by the sampled service describing
  the account behavior.
- `public_interface`: behavior visible without creating, changing, or
  authenticating an account and without submitting a password.

Third-party articles can help locate official evidence but cannot establish a
study value.

## Missingness

`unknown` means the study did not establish the value within its safe evidence
boundary. `not_applicable` means the sampled account context does not use a
password or the control logically does not apply. Neither value belongs in the
denominator of a percentage unless the report explicitly states otherwise.