3 ms·

Then add NIST to the list of people you should be reaching out to (report linked from the homepage of pwnedpasswords): https://www.nist.gov/itl/tig/projects/sp

• royce 9y ago
  Indeed. One of the authors of 800-63B is actively involved in the password-research community, and is already aware that the guidance places no restrictions on blacklist size.