Common Password List

What a common password list does

A common password list is a defensive and offensive reference set: defenders use it to reject weak choices at enrollment or reset, while attackers use the same pattern to prioritize guesses that are likely to succeed quickly.

Why common password lists matter in authentication security

The value of a common password list is not that it “finds bad passwords” in the abstract, but that it reduces the odds of predictable secrets entering production accounts. It is one of the simplest ways to stop users from choosing passwords that are easy to guess, reused across sites, or already known to attackers from prior breaches.

That matters because password attacks often start with the cheapest possible attempt, a small set of high-probability passwords before moving to broader spraying or stuffing. A strong password blocklist raises the cost of that first step and improves the odds that the account system fails closed instead of accepting an obvious secret.

For practical guidance on how blocklists fit into a modern password policy, see the Password Policy Guide (NIST-aligned).

How attackers and defenders use the same lists differently

Defenders use common password lists to screen new passwords at creation time, during resets, and sometimes during periodic audits of existing credentials. The intent is preventive: stop weak choices before they become a standing authentication weakness.

Attackers use similar lists as a targeting aid for password guessing, spraying, and credential stuffing. The list itself is not the attack, but it helps an attacker concentrate effort on passwords that have historically appeared often enough to be worth trying first.

This is why common password lists should be treated as part of a broader authentication control set, not as a standalone fix. They work best when paired with rate limiting, lockout controls, MFA, and detection of repeated failed sign-ins.

What makes a password on the list dangerous

Passwords end up on these lists for predictable reasons: they are short, memorable, keyboard-pattern based, seasonal, or culturally common. Many also appear because they have been exposed in breaches and continue to be reused by users long after they were first compromised.

The security problem is predictability. A password that is easy for one person to remember is often easy for an attacker to enumerate, automate, or reuse across many accounts. Once that secret is guessed, the attacker may gain direct access without needing malware, phishing, or advanced exploitation.

For a defender, the key point is that “known-bad” passwords are an input to policy enforcement, not a substitute for broader authentication hygiene. A list can reject poor choices, but it cannot by itself prove that a password is unique, resistant to reuse, or safe against online guessing.

Where common password lists fit in an organisation

Most organisations use these lists inside sign-up, password change, and password reset flows, where the user is already committing to a new secret. Some also apply them in directory services or identity platforms so the same policy is enforced everywhere a password can be set.

They are most effective when the screening logic is consistent across channels. If one application blocks weak passwords but another accepts them, users will route around the stronger control and the organisation will inherit uneven protection.

For attack-path context and defensive detection around guessing, spraying, and stuffing, the MITRE ATT&CK T1110 Brute Force Guide is a useful companion. If you want a breach-aware way to screen for reused secrets, Breached password checks explains how compromised-password screening supports the same goal.

External guidance from NIST SP 800-63 Digital Identity Guidelines and NIST SP 800-53 Rev 5 Security and Privacy Controls also supports using strong authentication policy and password screening as part of a broader access-control program.

Risk and Threat Considerations

Common password lists matter because they sit directly on the boundary between user convenience and account compromise. If the list is too weak, too small, or inconsistently enforced, attackers can exploit predictable passwords through low-cost online guessing or reuse them in credential stuffing campaigns.

Failure mechanism: The password is accepted because the screening list misses it, is outdated, or is not applied consistently across systems, allowing a guessable secret to become a valid credential.

Impact: A successful guess can lead to account takeover, unauthorized access, session abuse, and follow-on activity that looks like a legitimate login rather than an exploit.

Practitioner Guidance

Why practitioners should care: A common password list is only useful when it is enforced at every password creation and reset path, not just in one application or one directory. The operational risk is fragmentation, because a bypass in one place weakens the entire authentication estate.

Common misunderstanding: A password list is not the same as a full password policy. It should be treated as one control inside a larger password and authentication strategy that also addresses length, reuse, throttling, monitoring, and recovery paths.

Practitioner takeaway: Keep the list current, enforce it consistently, and assume attackers will test the same weak-password patterns you are trying to block.

Related resources from NHI Mgmt Group

• Why do password spraying attacks evade common lockout controls?
• How should security teams prepare for AI application and agent access when password habits and credential reuse are common?
• What is the difference between a banned password list and continuous credential monitoring?
• How should security teams reduce the risk of SSO password reuse in the browser without relying only on domain or phishing list matching?