A password blocklist is a list of passwords that a system will refuse during account creation or password changes. It usually contains common passwords like 123456, seasonal favorites, keyboard patterns, and passwords known to have appeared in data breaches. Some blocklists also reject variants and passwords that match a user’s email or service name, because those choices are easy to guess or reuse.
In cyber security, blocklists matter because weak and reused passwords are a major path to account takeover. Attackers often test credentials from other breaches, then try obvious passwords against many accounts. A blocklist reduces the chance that a user can pick a guessable secret even before MFA is added. It is a defense against poor password choice, not a complete solution: it should be combined with rate limiting, breach-password checks, MFA, and monitoring for suspicious logins. In practice, strong password policy means banning bad choices, not just demanding more characters.