A note on the Thompson sampling: classic TS is optimizing for regret, while the goal here is to identify the 'best arm' (ie. the actual secret value at that position - it's like a 0/1 loss). There is no partial credit in getting part of a password correct, it still won't work. So it's a https://en.wikipedia.org/wiki/Multi-armed_bandit#Best_Arm_Id...

You can tweak the Thompson sampling to handle best-arm, like https://www.escholar.manchester.ac.uk/api/datastream?publica... "Ordered-Statistic Thompson Sampling". I am not sure if the pseudocode TS presented by OP winds up doing the same thing.