HUMAN VERIFICATION REQUIRED ASVS 6.5.4 Minimum entropy

Lookup secrets and out-of-band authentication codes have a minimum of 20 bits of entropy (typically 4 random alphanumeric characters or 6 random digits is sufficient).