This question already has an answer here:

We all know the basics "password rules" when a user register on a website, such as:

  • more than 8 characters,
  • must contain an upper case letter,
  • must contain numbers and so on

Why don't websites filter (as in not accept) well-known weak passwords such as:

  • 123456
  • qwerty
  • password

What are the pros and cons of such a method and why is it not widely used?

marked as duplicate by Xander, schroeder May 2 '16 at 15:22

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    New TRUSTe standards state that sites now must ban certain commonly used password words, like "password" and "123456" and repeating patterns, like "1111111" – schroeder May 2 '16 at 15:22

It's not used widely because if you block 123456, users will use 1234567, you block qwerty they'll use qwertyu. Honestly, "The blacklist approach will be bypassed". And this makes the outcome minimal, to the extent that its not worth implementing.

The approach could be beneficial but when coupled with other types of policies like min-length, uppercase, digits, etc. And you see this type of policy in action when systems prevent you from using your last 'x' passwords or alert you that your password can't contain your username. (And a lot of weak passwords are blocked via length/complexity rules)


I once implemented something like this. The longest known words would be removed from the password before checking its length. So if you enter "test438" as a password, "test" is removed and "438" is obviously too short to be a password. This still allows for passwords that combine multiple known words.

Some people that had passwords like "Test1234" complained about the new system.

Not the answer you're looking for? Browse other questions tagged or ask your own question.