The AIP-56 Human Recovery Key — a 544-bit recovery phrase built from 15 five-letter words with per-character mixed-case entropy.
Why?
Most websites treat account recovery as an afterthought.
You create an account, choose a password, and if that password is lost, the website sends a reset link by email. That is normal. It is familiar. It is also fragile.
Email accounts can be lost. Email accounts can be compromised. Email can be delayed, redirected, filtered, or accessed from places the account holder did not intend. A password reset link is convenient, but convenience is not the same thing as strong recovery.
AZ2 was built differently because AKADATA LIMITED believes systems should be understandable, recoverable, and deliberately designed. We do not copy a pattern simply because everyone else uses it. We ask what the pattern protects, what it fails to protect, and whether something better can be built without making the user's life harder.
That is why AZ2 uses the AIP-56 Human Recovery Key.
What is AIP-56?
AIP stands for AKADATA Improvement Proposal. AIP-56 is the AKADATA account recovery design used by AZ2. It gives the account holder a human-readable recovery phrase during registration. That phrase is designed to be written down, stored safely, and used only if account recovery is ever needed.
The purpose is simple: your password protects normal login, and your AIP-56 Human Recovery Key protects account recovery.
How It Works
When a new AZ2 account is created, the system generates a recovery phrase made from 15 five-letter words.
Those words are selected from a curated source of 9,074 five-letter words distributed across every letter of the alphabet. The system picks 2 words from each letter (a–z) at random, then selects 15 of those 52 in random order. The words are readable, but the phrase is not something a person could reasonably guess.
AIP-56 then adds another layer: letter case matters.
A word may be lowercase, uppercase, or mixed case. For example, these are different recovery values:
lodge
LODGE
lODgE
The word looks familiar to a human, but the exact upper and lower case pattern becomes part of the recovery key. The words matter. The order matters. The spaces matter. The letter case matters.
Why Mixed Case Matters
A five-letter word has five letters. If each letter can be either uppercase or lowercase, that one word has:
25 = 32
possible case forms.
A 15-word phrase contains 75 letters. That means the case layer alone creates:
275 = 37,778,931,862,957,161,709,568
possible case combinations for a single fixed 15-word phrase. That number is not the whole recovery strength. It is only the extra mixed-case layer added after the words themselves have already been selected.
Recovery Difficulty
Using the AIP-56 word source of 9,074 words and the AZ2 balanced word-selection design (2 random words per letter, then 15 in random order), the word selection stage gives:
469 bits
of recovery search space before letter case is added.
The mixed-case layer adds:
75 bits
Together, the AIP-56 Human Recovery Key has approximately:
544 bits
of recovery phrase space.
This is the approximate displayed recovery phrase search space, not a claim that every attack path is 544-bit.
Written as a number, that is roughly 5.7 × 10163 possible recovery phrases — a 5 followed by 163 more digits.
Sand grains are naturally occurring granular materials defined strictly by their size, ranging from 0.0625 mm to 2 mm in diameter. They fall between silt/clay and gravel, and are composed of eroded rock, silicate minerals like quartz, and microscopic fossils.
There are estimated to be roughly 7.5 × 1018 grains of sand on all the beaches on Earth. The AIP-56 recovery space is so large you could assign a unique recovery phrase to every single grain of sand on every beach, and still have more phrases left over than there are atoms in a thousand galaxies.
It is breath that gives life. Who can count the grains of sand?
Compared with Website Encryption
When a browser connects securely to a website, the connection normally uses transport encryption such as TLS. People often talk about 128-bit and 256-bit encryption in that context.
A 128-bit key has 2128 possible values. A 256-bit key has 2256 possible values.
128-bit
AES-128
256-bit
AES-256
544-bit
AIP-56
The AIP-56 Human Recovery Key, at 544 bits, is not the same thing as TLS encryption. TLS protects data while it travels between browser and server. AIP-56 protects the account recovery path.
They solve different problems. But the comparison is still useful: AIP-56 is not a short PIN, not a normal password hint, and not a simple email reset link. It is a high-entropy human recovery key that can be read, written down, and kept by the account holder.
What AZ2 Stores
AZ2 shows the recovery phrase during registration so the account holder can record it.
After that point, the original phrase is never stored. AZ2 stores only a cryptographic hash of the phrase using the Argon2id algorithm — a memory-hard, computationally intensive function designed to resist brute-force and GPU-based attacks.
When you enter your recovery phrase during password reset, AZ2 hashes what you type and compares it against the stored hash. The original words are never reconstructed, and AZ2 cannot safely show them again.
This is intentional. A recovery phrase should not behave like a normal profile setting. It is closer to a key. The account holder is expected to keep it somewhere safe.
What the stored hash looks like
$argon2id$v=19$m=65536,t=3,p=1$MFN6YkJ3bFVqNXA5ejJQdg$8/q9BBsMCQnpeGLiZnOptUnHzjJMVZ1VRJfw+eF96eY
│ │ │ │ │
│ │ │ │ └─► [3. THE RAW OUTPUT DIGEST]
│ │ │ │ The final 32-byte Argon2id output.
│ │ │ │ Compared during password reset.
│ │ │ │
│ │ │ └────────────────────────► [2. THE CRYPTOGRAPHIC SALT]
│ │ │ A unique random 16-byte value per user.
│ │ │ No two accounts share the same salt,
│ │ │ preventing pre-computed rainbow table attacks.
│ │ │
│ │ └──────────────────────────────────────► [1. THE HARDWARE CONSTRAINT TUNING]
│ │ 64 MB memory cost (m),
│ │ 3 time passes (t),
│ │ 1 thread (p).
│ │ Makes each verification deliberately
│ │ expensive in memory and CPU.
│ │
│ └──────────────────────────────────────────► [Argon2 Version 19]
│ The current Argon2 version standard.
│
└───────────────────────────────────────────────────► [Argon2id Hybrid Profile]
Combines Argon2i (data-independent,
side-channel resistant) and Argon2d
(GPU-resistant).
Passwords Still Matter
The AIP-56 Human Recovery Key protects account recovery. It does not make a weak password safe.
Your AZ2 account is still only as secure as the password you choose for normal login. A reused password, a short password, or a password already exposed elsewhere can still place an account at risk. Use a long, unique password that is not used on other websites.
Think of it this way: your password opens the front door. Your AIP-56 Human Recovery Key protects the recovery path if that front door key is lost. Both matter.
How to Keep the Recovery Phrase Safe
Write the phrase down exactly as shown.
Keep the word order exactly the same.
Keep the letter case exactly the same.
Do not send it by email.
Do not paste it into chat.
Do not post screenshots of it.
Do not store it somewhere other people can access.
If printing it, keep the printout somewhere private. The safest recovery phrase is one that the account holder can find when needed, and nobody else can find at all.
Why AKADATA Does This
AKADATA exists to build systems with ownership, clarity, and resilience.
That means not depending blindly on the same recovery pattern used everywhere else. It means giving the account holder a recovery method that is understandable without being weak.
AIP-56 is part of that principle.
We lead by example. We do not follow the crowd for the sake of fitting in. AZ2 account recovery is built to be human-readable, technically strong, and deliberately different.
Questions?
If you have questions about account recovery or the AIP-56 standard, please reach out through our contact page.
