A password blocklist is a rejected list of common, leaked, or easily guessed passwords that users are prevented from choosing. In practice, it is a direct control against predictable credential selection and is more effective than forcing arbitrary character patterns that do not change guessability.
What a password blocklist does
A password blocklist stops users from choosing passwords that are known to be weak, common, leaked, or otherwise easy to guess. It is a practical control against predictable credential selection, and it works best when it screens out high-risk choices at account creation and password change time rather than relying on arbitrary character rules alone.
That distinction matters because a password can satisfy length or complexity rules and still be highly guessable. Blocklisting targets the real problem, which is whether an attacker can predict, reuse, or automate guesses against the credential.
Why blocklists are more effective than complexity-only rules
Traditional password complexity policies often create passwords that are awkward for users but still weak in practice. A blocklist is designed around actual guessability, which means it can reject passwords that are too common, appear in breach corpora, or follow obvious patterns that attackers test first.
This is why modern password guidance increasingly treats blocklisting as a core control, not an optional add-on. The control does not guarantee strong credentials by itself, but it removes the most obvious failure mode, choosing something the attacker already expects.
For a policy-oriented view of how blocklisting fits into modern password controls, see the Password Policy Template, which aligns blocklist screening with other practical password rules.
What belongs in a password blocklist
A useful blocklist is broader than a simple list of dictionary words. It should include common passwords, variants built from predictable substitutions, leaked passwords exposed in breaches, and organisation-specific patterns such as the company name, seasons plus numbers, or repeated keyboard sequences. The aim is to reject passwords that are easy to guess even if they are not literally on a short public list.
The best implementations also consider whether a password appears in known compromise datasets and whether it resembles a high-frequency pattern seen in attacks. That makes the blocklist a living control, not a static one-time list.
For that breach-informed approach, the Breached password checks guide shows how compromise data and login-flow screening can strengthen password selection decisions.
How organisations use blocklists in practice
Blocklists are most effective when they are built into the password enrollment workflow, enforced consistently across user populations, and paired with modern authentication controls. They are especially important where password reuse, credential stuffing, or password spraying are realistic threats, because the weakest passwords are the easiest to exploit at scale.
In practice, organisations should treat the blocklist as one part of a wider password policy that also addresses minimum length, password manager use, and rapid replacement of exposed credentials. The control is strongest when it reduces predictable choices before they can become valid credentials.
For a broader reference on password policy design and modern guidance, the Password Security and Password Manager Guide covers blocklisting alongside password reuse, breach exposure, and the move away from brittle complexity habits.
Blocklists, compromise exposure, and user experience
Blocklists reduce avoidable risk, but they need careful tuning. If the list is too narrow, weak passwords will still pass. If it is too aggressive or poorly maintained, users may struggle to choose usable passwords and start searching for workarounds. The control should therefore be specific enough to reject predictable choices without creating unnecessary friction.
Used well, a blocklist improves both security and usability because it removes the passwords attackers most often test first, while leaving users free to choose longer, less predictable passphrases. That is the real value of the control: it improves guess resistance directly, rather than indirectly through symbolic rules.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Defines screening and lifecycle handling for passwords and other authenticators. |
| IA-2 — Identification and Authentication (Organizational Users) | Requires strong user authentication, where password quality is a core input to account security. | |
| Recommendation — Enforce screened authenticator policies and reject weak or compromised passwords before they become valid credentials. Apply authenticated account controls that depend on rejecting weak password choices during enrollment and change. | ||
| NIST SP 800-63 | Digital Identity Guidelines | Guidance for password screening and rejecting weak memorized secrets in digital identity systems. |
| Recommendation — Use the digital identity guidance to screen out common, compromised, and easily guessed passwords. | ||
| CIS Controls v8 | 5 — Account Management | Covers practical account and credential governance, including stronger password handling. |
| Recommendation — Implement account controls that prevent weak passwords and reduce predictable credential selection. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org