Banned Password List

What a banned password list does

A banned password list is a preventive control, not a scoring system. It stops users from choosing passwords that are already known to be weak, predictable, or exposed, so the organisation can reject dangerous secrets before they are accepted into production.

Its value is highest at the point of creation and reset, where weak choices are easiest to prevent and hardest to clean up later. Because the list operates before account use begins, it reduces the chance that obvious passwords become the foundation for later guessing, spraying, or stuffing attempts.

Why blocklists matter in password policy

Blocklists work best when they are treated as one layer in a broader password policy rather than as a replacement for length, rate limiting, or phishing-resistant authentication. They are especially useful because many user-chosen passwords fail in the same ways: they reuse common patterns, include keyboard sequences, or mirror breached credentials that attackers already expect.

This is why modern guidance tends to pair banned password screening with stronger password requirements and compromise checks. A good policy prevents both trivially guessed secrets and passwords that have already been exposed elsewhere, which closes a gap that complexity rules alone often leave open.

In practice, the list should be large enough and current enough to catch obvious choices, but not so rigid that it creates unnecessary friction for legitimate users. The control is about reducing predictable risk, not about making passwords obscure for their own sake.

How organisations use banned password screening

The most effective implementations check candidate passwords during set, change, and reset flows, then reject any match against the blocklist before the password is committed. Good implementations also apply the same logic consistently across directories, cloud identity systems, and password self-service paths so users cannot bypass one enforcement point and succeed in another.

Many organisations strengthen the blocklist with breach-derived passwords, organisation-specific terms, seasonal patterns, brand names, and local variants that attackers can guess quickly. When combined with sensible password length rules, this narrows the set of choices to passwords that are both harder to predict and less likely to already be in attacker datasets.

NHIMG’s Password Policy Guide (NIST-aligned) covers how blocklist screening fits into a fuller password policy, including length, enforcement, and auditability.

For password reuse and brute-force resilience, organisations should also align the blocklist with detection and response controls that spot repeated guessing and credential abuse. That makes the password policy part of a larger defensive chain rather than a standalone gate.

NHIMG’s MITRE ATT&CK T1110 Brute Force Guide explains how guessing, spraying, and stuffing behave from the defender’s point of view.

Relationship to breached and dangerous passwords

A banned password list is often most effective when it includes passwords that have been seen in breaches or are otherwise known to be high risk. That matters because exposed passwords are rarely just weak, they are already part of the attacker’s playbook, which makes them disproportionately dangerous even if they appear complex to the user who created them.

The practical distinction is that a generic weak-password list blocks obvious choices, while a breached-password source blocks secrets that have already crossed into hostile datasets. In mature programs, both are useful because they catch different kinds of bad choice, and the overlap between them is not complete.

NHIMG’s Breached password checks explains how exposed-password screening works and how it supports safer login and reset flows.

Used well, the banned list improves the quality of the starting point. It does not make passwords invulnerable, but it removes some of the easiest and most abused failures from the environment before attackers can exploit them.

Risk and Threat Considerations

Weak or absent banned-password screening leaves organisations exposed to predictable choices, password spraying, and credential stuffing, especially when users recycle common words or breached passwords across services. The risk is not just account compromise, but also the false confidence that comes from having a password policy that looks strict while still accepting highly guessable secrets.

Failure mechanism: Attackers test common passwords, breached passwords, and pattern-based guesses at scale, and a permissive reset or creation flow accepts one of those choices as valid credentials.

Impact: Accounts become easier to compromise, reused credentials are more likely to succeed elsewhere, and downstream access control, monitoring, and incident response must absorb a preventable identity failure.

Practitioner Guidance

Why practitioners should care: A banned password list is only useful if it is enforced everywhere users can create or reset passwords. Gaps between directories, cloud identity systems, and self-service workflows are where weak passwords usually slip through.

Common misunderstanding: A blocklist is not a substitute for strong password policy. It is a targeted control that removes known-bad choices, while length, throttling, and compromise checks address different failure modes.

Practitioner takeaway: Treat the banned password list as an enforcement control with audit value, then verify that the same logic is applied consistently across every password entry path.

Related resources from NHI Mgmt Group

• What is the difference between a banned password list and continuous credential monitoring?
• How do you configure a custom banned password list in Microsoft Entra ID?
• How should organisations defend against compromised passwords beyond basic banned-password checks?
• How should security teams reduce the risk of SSO password reuse in the browser without relying only on domain or phishing list matching?