Password Banned List

What a password banned list does

A password banned list is a control for screening out weak, guessable, or previously exposed passwords before they can be set. It is typically applied during password creation or reset, and it works best when the blocked set reflects real attacker behaviour, common user choices, and current breach data.

The practical value is not just that it rejects obvious choices like seasonal words or keyboard patterns. A good banned list also closes gaps left by length rules alone, because long but predictable passwords can still be easy to guess or crack if they are based on common phrases, company names, or reused patterns.

Why banned lists matter for password policy

Password bans are one of the few password controls that directly target what users actually choose, rather than only setting format rules. That makes them a useful complement to minimum length and multi-factor authentication, especially where legacy systems, fallback flows, or shared admin paths still depend on passwords.

They also improve policy consistency. Without a banned list, two users can satisfy the same complexity rule while one chooses a weak credential that is far easier to guess or spray. A banned list narrows that gap by blocking candidates that are known to be popular, recycled, or closely associated with exposed password corpora.

For a broader policy view, NHIMG’s Password Policy Guide (NIST-aligned) explains how blocklist screening fits into modern password policy design, including length, auditability, and policy drift.

How blocked passwords are usually checked

In practice, the screening step compares a proposed password against a curated list, then applies matching logic that may include exact matches, case variations, common substitutions, and pattern checks. Some implementations also compare against organisation-specific terms such as the company name, product names, or predictable seasonal variants.

The most effective lists are usually layered. One layer blocks very common passwords, another layer blocks compromised passwords drawn from breach intelligence, and another layer blocks local business terms that would be easy for an attacker to guess. This is why a password banned list is often discussed alongside breached password screening rather than as a standalone tactic.

NHIMG’s Breached password checks resource shows how compromised-password screening works with services such as Have I Been Pwned and why those checks are more effective than relying on format rules alone.

Security implications and common failure modes

Weak password selection remains attractive to attackers because it supports password spraying, credential stuffing, and low-cost guessing at scale. A banned list reduces the pool of likely choices, but it does not eliminate those attack paths on its own. If usernames are predictable, rate limits are weak, or legacy authentication is still enabled, attackers can still succeed with a small number of attempts.

The main failure mode is a list that is too small or too static. If it only blocks a handful of obvious examples, users will quickly adapt by making trivial substitutions that remain guessable. Another failure mode is over-blocking, where the list frustrates legitimate users without materially improving security. The control only works when it is maintained, tested, and aligned with the organisation’s real exposure.

NHIMG’s MITRE ATT&CK T1110 Brute Force Guide is useful for understanding why banned lists help against guessing, spraying, and stuffing, and why they must be paired with detection and throttling controls.

Where password banned lists fit in a stronger control set

A password banned list is best treated as one layer in a wider authentication strategy. It should sit alongside strong password length requirements, rate limiting, smart lockout, MFA, and review of any systems that still allow weaker fallback authentication. It is also important to retest the policy over time, because breach data and attacker tradecraft evolve.

For organisations that manage passwords across directory services and cloud identity platforms, the operational question is not just whether a banned list exists, but whether it is actually enforced at every password change path. If self-service reset, admin reset, and application-specific stores do not share the same screening logic, the control becomes inconsistent and easier to bypass.

External guidance from NIST SP 800-63 Digital Identity Guidelines and NIST SP 800-53 Rev 5 Security and Privacy Controls is a useful reference point for password screening, authentication strength, and control discipline.

Related resources from NHI Mgmt Group

• What is the difference between a banned password list and continuous credential monitoring?
• How do you configure a custom banned password list in Microsoft Entra ID?
• Banned Password List
• How should organisations defend against compromised passwords beyond basic banned-password checks?