[
  {"name": "nist-800-63b-4-single-factor", "minLength": 15, "maxLength": 128, "minCharacterClasses": 0, "blockCommon": true, "blockPersonal": true, "source": "NIST SP 800-63B-4 (26 August 2025) section 3.1.1.2: a password that is the only factor SHALL be at least 15 characters; no composition rules; blocklist and context-specific words checked"},
  {"name": "nist-800-63b-4-multi-factor", "minLength": 8, "maxLength": 128, "minCharacterClasses": 0, "blockCommon": true, "blockPersonal": true, "source": "NIST SP 800-63B-4 (26 August 2025) section 3.1.1.2: a password used only with a second factor SHALL be at least 8 characters; no composition rules; blocklist and context-specific words checked"},
  {"name": "composition-12-3", "minLength": 12, "maxLength": 128, "minCharacterClasses": 3, "blockCommon": true, "blockPersonal": true, "source": "For organisations whose own rules still demand character classes: 12 characters and 3 of the 4 classes. NIST SP 800-63B-4 says SHALL NOT impose composition rules"}
]