I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this blacklist in the database?

  • 1
    I think security implication is out of context for your question more relevant question would be what benefit we can get and how to maintain such a list. Your can also review previous post on same topic security.stackexchange.com/questions/39051/…
    – Ali Ahmad
    Aug 18, 2013 at 14:51
  • 5
    I'm the author of the similar question linked to above--which was marked [duplicate] and didn't receive much attention. Then this question comes along and gets crazy upvoted. I will never understand how these SE sites work. Aug 22, 2013 at 20:40
  • See also: Banning specific passwords?
    – unor
    Aug 23, 2013 at 14:47

5 Answers 5


In that order of magnitude (1000 passwords), I don't see any down sides from a security point of view. If anything, I'd say it's a good idea. Granted, you'll be shrinking the pool of possible passwords which, theoretically, decreases the security. In practice, however, those most commonly used passwords will be one of the first wordlists an attacker would try.

In fact, I've seen a few web services disclosing this in their registration forms. Some even block whole dictionaries in addition to common passwords.

  • 6
    I wouldn't be surprised if people choosing xyz for a password just change it to xyz1 after getting a message that their password is blacklisted. Now as an attacker you could try some simple variations of words in the blacklist first, before brute-forcing.
    – Aerus
    Aug 19, 2013 at 9:53
  • I agree with @Aerus, you should consider making a powerful statement to users at the point of refusing their password on the grounds you detected it was too weak, to ensure they don't simply append a single character to get around the blacklist. User education is paramount. Also, consider preventing enumeration of the blacklisted passwords.
    – deed02392
    Aug 19, 2013 at 12:50
  • @Aerus, what about using a Levenshtein compare to also prevent xyz1? Jan 13, 2016 at 4:00

Not only is this not a bad idea, it's actually quite advisable. In fact, there's a whole library already included on most Linux/Unix systems called cracklib which helps you prevent users from picking horrible passwords.

There are bindings for this library in most languages, which makes checking for bad passwords pretty trivial. You just say "cracklib, is this password bad" and it will say something like: "this password is based on a reversed dictionary word".


From a security perspective, there should be no negative implications. The only thing I can think of will be the attacker knowing not to try those 1000 passwords if he manages to get hold of that list but that's really doesn't count.

  • That's what I was thinking. Just sharing it with the community before implementing.
    – Gajus
    Aug 18, 2013 at 9:51
  • 7
    60^8-1000 isn't that bad really... Aug 19, 2013 at 1:11
  • Even 60^8-<a few millions> ... Jan 13, 2016 at 4:17

I can see one problem in this situation, it will make brute force easier for the attacker. They will have fewer passwords to try in order to break into the account. I think you should not limit password choice to users at all.

  • 9
    Removing 1000 passwords from the potential passwords to try will have a negligible impact on the attacker's workload. The point here is to prevent people picking 123456, password, guest, etc.. think of it as those pesky password rules, but more controlled and sane.
    – Thomas
    Aug 18, 2013 at 15:37

If you make the blacklist public and it has your boss's favorite password CarlosDanger77 in it; chances are you are getting canned when his Twitter account gets hacked with it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .