{
    "dataset": "The Pass Key 2026 Password, Passphrase & PIN Cryptographic Entropy & Offline GPU Crack-Time Benchmarks",
    "version": "2026.10",
    "license": "https://creativecommons.org/publicdomain/zero/1.0/",
    "publisher": {
        "name": "The Pass Key",
        "url": "https://thepasske.com/",
        "contact": "contact@thepasske.com"
    },
    "formula": {
        "shannon_keyspace_entropy": "H = L * log2(N)",
        "variables": {
            "H": "Cryptographic entropy in bits",
            "L": "Length of credential (characters, words, or digits)",
            "N": "Pool size of independent symbols (26 lowercase, 52 mixed-case, 62 alphanumeric, 94 printable ASCII, 7776 EFF Diceware words, 10 numeric digits)"
        },
        "csprng_implementation": "window.crypto.getRandomValues(new Uint32Array(L)) via W3C Web Cryptography API"
    },
    "password_benchmarks": [
        {
            "length": 8,
            "pool": "Lowercase only (26)",
            "pool_size": 26,
            "entropy_bits": 37.60000000000000142108547152020037174224853515625,
            "crack_time_100B_per_sec": "2 seconds",
            "crack_time_bcrypt_cost12": "19 days",
            "crack_time_argon2id": "92 days",
            "rating": "Unsafe"
        },
        {
            "length": 8,
            "pool": "Alphanumeric (62)",
            "pool_size": 62,
            "entropy_bits": 47.60000000000000142108547152020037174224853515625,
            "crack_time_100B_per_sec": "36 minutes",
            "crack_time_bcrypt_cost12": "29 years",
            "crack_time_argon2id": "138 years",
            "rating": "Weak"
        },
        {
            "length": 10,
            "pool": "Alphanumeric (62)",
            "pool_size": 62,
            "entropy_bits": 59.5,
            "crack_time_100B_per_sec": "97 days",
            "crack_time_bcrypt_cost12": "111,000 years",
            "crack_time_argon2id": "530,000 years",
            "rating": "Low-Risk Only"
        },
        {
            "length": 12,
            "pool": "Full ASCII Upper+Lower+Digits+Symbols (94)",
            "pool_size": 94,
            "entropy_bits": 78.599999999999994315658113919198513031005859375,
            "crack_time_100B_per_sec": "150 million years",
            "crack_time_bcrypt_cost12": "1.2e14 years",
            "crack_time_argon2id": "6.0e14 years",
            "rating": "Minimum Baseline (PCI DSS 4.0)"
        },
        {
            "length": 16,
            "pool": "Full ASCII Upper+Lower+Digits+Symbols (94)",
            "pool_size": 94,
            "entropy_bits": 104.900000000000005684341886080801486968994140625,
            "crack_time_100B_per_sec": "1.2e13 years",
            "crack_time_bcrypt_cost12": ">1e19 years",
            "crack_time_argon2id": ">1e20 years",
            "rating": "Strong (NIST / CCCS / ENISA Recommended)"
        },
        {
            "length": 20,
            "pool": "Full ASCII Upper+Lower+Digits+Symbols (94)",
            "pool_size": 94,
            "entropy_bits": 131.099999999999994315658113919198513031005859375,
            "crack_time_100B_per_sec": "9.6e20 years",
            "crack_time_bcrypt_cost12": ">1e27 years",
            "crack_time_argon2id": ">1e28 years",
            "rating": "Very Strong (128-Bit Class)"
        },
        {
            "length": 24,
            "pool": "Full ASCII Upper+Lower+Digits+Symbols (94)",
            "pool_size": 94,
            "entropy_bits": 157.30000000000001136868377216160297393798828125,
            "crack_time_100B_per_sec": ">1e28 years",
            "crack_time_bcrypt_cost12": ">1e34 years",
            "crack_time_argon2id": ">1e35 years",
            "rating": "Maximum (Admin & Vaults)"
        },
        {
            "length": 40,
            "pool": "Full ASCII Upper+Lower+Digits+Symbols (94)",
            "pool_size": 94,
            "entropy_bits": 262.19999999999998863131622783839702606201171875,
            "crack_time_100B_per_sec": ">1e60 years",
            "crack_time_bcrypt_cost12": ">1e66 years",
            "crack_time_argon2id": ">1e67 years",
            "rating": "256-Bit Cryptographic Secret"
        }
    ],
    "passphrase_benchmarks": [
        {
            "words": 3,
            "wordlist_size": 7776,
            "base_entropy_bits": 38.7999999999999971578290569595992565155029296875,
            "with_caps_and_digit_bits": 48.7999999999999971578290569595992565155029296875,
            "crack_time_100B_per_sec": "1.3 hours",
            "recommended_use": "UK NCSC Three Random Words (rate-limited logins & guest Wi-Fi)"
        },
        {
            "words": 4,
            "wordlist_size": 7776,
            "base_entropy_bits": 51.7000000000000028421709430404007434844970703125,
            "with_caps_and_digit_bits": 61.7000000000000028421709430404007434844970703125,
            "crack_time_100B_per_sec": "1.2 years",
            "recommended_use": "Everyday accounts typed on mobile or smart TV"
        },
        {
            "words": 5,
            "wordlist_size": 7776,
            "base_entropy_bits": 64.599999999999994315658113919198513031005859375,
            "with_caps_and_digit_bits": 74.599999999999994315658113919198513031005859375,
            "crack_time_100B_per_sec": "9,400+ years",
            "recommended_use": "Default recommended for master passwords & WPA3 Wi-Fi"
        },
        {
            "words": 6,
            "wordlist_size": 7776,
            "base_entropy_bits": 77.5,
            "with_caps_and_digit_bits": 87.5,
            "crack_time_100B_per_sec": "73 million years",
            "recommended_use": "Password manager vaults & BitLocker/FileVault/LUKS disk encryption"
        },
        {
            "words": 8,
            "wordlist_size": 7776,
            "base_entropy_bits": 103.400000000000005684341886080801486968994140625,
            "with_caps_and_digit_bits": 113.400000000000005684341886080801486968994140625,
            "crack_time_100B_per_sec": ">1e15 years",
            "recommended_use": "SSH keys, PGP keys & cold-storage backups"
        }
    ],
    "pin_benchmarks": [
        {
            "digits": 4,
            "combinations": 10000,
            "entropy_bits": 13.300000000000000710542735760100185871124267578125,
            "ten_attempt_guess_probability": 0.001000000000000000020816681711721685132943093776702880859375,
            "recommended_use": "Legacy bank ATMs & fixed 4-digit locks"
        },
        {
            "digits": 6,
            "combinations": 1000000,
            "entropy_bits": 19.89999999999999857891452847979962825775146484375,
            "ten_attempt_guess_probability": 1.0000000000000000818030539140313095458623138256371021270751953125e-5,
            "recommended_use": "iOS/Android lock screens & carrier SIM PINs"
        },
        {
            "digits": 8,
            "combinations": 100000000,
            "entropy_bits": 26.60000000000000142108547152020037174224853515625,
            "ten_attempt_guess_probability": 9.99999999999999954748111825886258685613938723690807819366455078125e-8,
            "recommended_use": "FIDO2 hardware security keys (YubiKey) & carrier port-freeze PINs"
        },
        {
            "digits": 10,
            "combinations": 10000000000,
            "entropy_bits": 33.2000000000000028421709430404007434844970703125,
            "ten_attempt_guess_probability": 1.0000000000000000622815914577798564188970686927859787829220294952392578125e-9,
            "recommended_use": "High-security device encryption & admin kiosks"
        },
        {
            "digits": 12,
            "combinations": 1000000000000,
            "entropy_bits": 39.89999999999999857891452847979962825775146484375,
            "ten_attempt_guess_probability": 9.99999999999999939496969281939810930172340963650867706746794283390045166015625e-12,
            "recommended_use": "Numeric-only master vaults & recovery PINs"
        }
    ],
    "most_common_compromised_pins": {
        "four_digit_top_20": [
            "1234",
            "1111",
            "0000",
            "1212",
            "7777",
            "1004",
            "2000",
            "4444",
            "2222",
            "6969",
            "9999",
            "3333",
            "5555",
            "6666",
            "1122",
            "1313",
            "8888",
            "4321",
            "2001",
            "1010"
        ],
        "six_digit_top_10": [
            "123456",
            "111111",
            "000000",
            "121212",
            "654321",
            "666666",
            "112233",
            "123123",
            "789456",
            "159753"
        ]
    },
    "regional_standards_matrix": [
        {
            "region": "United States (USA)",
            "authority": "NIST SP 800-63B Rev 4 & CISA",
            "minimum_length": "8 chars (15+ chars recommended; 16+ chars best practice)",
            "periodic_rotation": "Prohibited unless evidence of compromise",
            "mfa_policy": "Phishing-resistant MFA (FIDO2/WebAuthn passkeys)"
        },
        {
            "region": "Canada",
            "authority": "Canadian Centre for Cyber Security (CCCS ITSP.30.030)",
            "minimum_length": "12+ char passwords or 4+ word passphrases (15+ chars)",
            "periodic_rotation": "Change only on suspected compromise",
            "mfa_policy": "Mandatory MFA on email, banking, cloud & remote access"
        },
        {
            "region": "United Kingdom (UK)",
            "authority": "UK NCSC & Cyber Essentials",
            "minimum_length": "Three Random Words passphrase or 12\u201316+ char generated password",
            "periodic_rotation": "Never force routine expiry",
            "mfa_policy": "2-Step Verification (2SV) across all cloud and admin accounts"
        },
        {
            "region": "European Union (EU / EEA)",
            "authority": "ENISA, NIS2 Directive & GDPR Art. 32",
            "minimum_length": "High-entropy unique credentials via cryptographic randomness",
            "periodic_rotation": "Event-driven rotation with continuous breach screening",
            "mfa_policy": "Multi-factor authentication & zero-knowledge storage"
        },
        {
            "region": "Global Payment Card Industry",
            "authority": "PCI DSS v4.0 Requirement 8.3.6",
            "minimum_length": "12 characters minimum (numeric + alphabetic)",
            "periodic_rotation": "Not required when MFA or continuous risk analysis is active",
            "mfa_policy": "MFA required for all access into the Cardholder Data Environment (CDE)"
        }
    ]
}