SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-password-blocklist

What should a service check when a user creates a password?

Check the proposed password against a blocklist of common or compromised choices.

Start playing free

  1. A common-password blocklist ✔
  2. The user's browsing history
  3. The computer's file names

Why: Attackers try passwords that already appear in breaches, dictionaries, and service-specific guesses. Rejecting those high-probability choices makes online guessing less effective.

Huh, didn't know that: The service name and username can be useful context-specific blocklist entries.

The dad joke
The password blocklist said, 'You again, Password1?'
Like this card?
Play the game

References

Answer: A common-password blocklist. Attackers try passwords that already appear in breaches, dictionaries, and service-specific guesses. Rejecting those high-probability choices makes online guessing less effective.

  1. NIST SP 800-63B pages.nist.gov/800-63-4/sp800-63b.html
    verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich password property most directly increases resistance to guessing?Security & PrivacyWhat does current NIST guidance say about password composition rules?Security & PrivacyWhich three goals form the CIA triad?

That's stuff everyone should know.