Custom Password Dictionary

A custom password dictionary is an organisation-specific list of terms that should not appear in passwords, such as company names, locations, local sports teams, or product names. It blocks context-specific guesses that attackers often test because they are easy to predict from the target’s environment and culture.

Expanded Definition

A custom password dictionary is a local policy layer that rejects passwords containing organisation-specific words, phrases, and naming patterns. It is usually paired with normal password strength rules, but it serves a different purpose: stopping easy guesses that are unique to the target environment.

What makes the control useful is its context sensitivity. Generic password checks catch short or reused passwords, but they often miss the words attackers infer from public sources, employee profiles, product branding, office locations, partner names, or internal jargon. A custom dictionary turns those predictable clues into disallowed terms, which raises the cost of guessing without forcing users into arbitrary complexity for its own sake.

In practice, this control sits between basic password policy and broader authentication governance. It does not replace MFA, credential monitoring, or breach-based password screening. It is one layer in a larger account protection strategy, and its value depends on keeping the dictionary current as the organisation changes names, brands, mergers, office sites, and product lines.

A common implementation mistake is treating the dictionary as a static list that is created once and forgotten. If the organisation changes its public language but the dictionary does not, attackers gain a set of easy, highly relevant guesses that still appear “different enough” to pass conventional checks.

Examples and Use Cases

Custom password dictionaries are most useful where attackers can easily learn the target’s vocabulary before attempting guessing or credential stuffing.

• Blocking a company name, internal project name, or product name that employees are likely to choose because it feels memorable.
• Rejecting office locations, city names, sports teams, or mascots that appear in public webpages and social media.
• Adding merger, acquisition, or rebrand terms after a corporate change so old naming patterns do not become password hints.
• Including executive surnames, helpdesk terminology, or customer-facing brand language when those terms are widely exposed.
• Feeding the dictionary from observed patterns in weak passwords so the policy reflects what users actually tend to choose.

The tradeoff is usability versus precision. If the dictionary is too broad, it frustrates users with rejections that feel arbitrary. If it is too narrow, it misses the very words attackers are most likely to test. The control works best when the list is targeted, explainable, and aligned to the organisation’s public footprint.

Security Implications

When a custom password dictionary is absent or poorly maintained, attackers can cheaply test passwords built from highly contextual words that standard composition rules do not block. That is especially valuable in targeted guessing attacks, where the attacker already knows the victim’s brand language and environment.

It also reduces the likelihood that password strength checks become a false sense of security. A password can satisfy length and character rules while still being easy to predict if it contains the organisation’s name, a product acronym, or a local reference. The result is weaker entropy than the policy appears to enforce.

Failure mechanism: predictable organisation-specific terms enter the candidate password space, making targeted guessing faster and more successful. Because these terms are often shared across many users, one weak policy decision can create repeated exposure across multiple accounts.

Impact: higher account takeover risk, faster success for password-spraying or targeted guessing, and a larger blast radius when one predictable theme is reused across users or systems.

Security, Operational and Governance Implications

A custom password dictionary is most effective when treated as a living control rather than a one-time rule set. Governance matters because the organisation’s public language changes over time, and the control has to track those changes to stay meaningful.

It also works best as part of a layered identity protection model. Dictionary checks help reduce predictable passwords, but they do not address breached credentials, reused passwords, or phishing capture on their own. That means the practical question is not whether to use the control in isolation, but how to keep it aligned with other authentication safeguards.

From an operational standpoint, the control needs ownership. Security or identity teams should decide who updates the list, how exceptions are handled, and when business changes such as rebrands or new product launches trigger a review. Without that lifecycle, the dictionary quickly becomes stale and loses the very context it was meant to enforce.

Related resources from NHI Mgmt Group

• What breaks when custom roles are not used in enterprise password management?
• How should organisations structure custom fields in password managers to reduce manual entry and support safer autofill?
• Who should manage custom field standards when password vaults are used across desktop, browser, and mobile clients?
• Custom Dictionary