SP800-63b

Making Passwords Random

and how passwords typically get brute-forced...