Password Check Dictionary

A password check dictionary is a list of passwords, passphrases, and patterns that an organization prevents users from selecting. It may include passwords exposed in previous data breaches, commonly used passwords, predictable words or phrases, default credentials, and password combinations that are too easy for attackers to guess. A password check dictionary or disallow list can evaluate a proposed password during account creation, password updates, and/or self-service password resets. If the password matches an entry on the list, the system blocks it and requires the user to choose another.

This type of password protection is critical because password length and character requirements alone do not always produce strong passwords. Users often respond to complexity requirements in predictable ways, such as changing “password” to “Password1!” or adding a number to a familiar word. Organizations can adjust password complexity rules and encourage employees to create longer passphrases, but they also need a way to disallow certain passwords that are already known to be common, compromised, or associated with the organization. This is an effective way to stop people from using common passwords and to make passwords more complex without solely relying on increasingly complicated composition rules.

By preventing weak passwords from entering the environment, a password check dictionary can help mitigate cybersecurity attacks that depend on password guessing, credential stuffing, dictionary attacks, and other forms of account compromise. It reduces the likelihood that an attacker will succeed with a password found in a breach, a common phrase, or a predictable variation of an existing password. However, it cannot stop password phishing or stealing when users intentionally or accidentally disclose strong passwords to attackers. Password check dictionaries should therefore be used alongside multifactor authentication, phishing-resistant authentication, rate limiting, monitoring, and other controls designed to reduce credential theft. They are a practical element of password management for IT teams because administrators can maintain a centralized, organization-specific list of prohibited credentials rather than relying on users to recognize password risk themselves.

Imprivata Enterprise Access Management (EAM) includes a password check dictionary that helps security-conscious organizations prevent the use of known or weak passwords. Administrators can upload a file containing disallowed passwords, and EAM blocks matching passwords during self-service password resets and password updates. This gives organizations a centralized way to apply an additional password control to accounts that still require traditional passwords or offer them as an authentication option. The capability can also help law enforcement organizations address applicable CJIS Security Policy 6.0 requirements related to strong password selection and the use of automated tools to help users select strong password authenticators.