A minimal compliant implementation could likely be ["passw0rd"]. Hopefully most compliant systems try a little harder, but with time and budget pressures... Id

A minimal compliant implementation could likely be ["passw0rd"]. Hopefully most compliant systems try a little harder, but with time and budget pressures... Ideally a modern system should use haveibeenpwned or atleast one of the various lists you can find in password cracking forums.