Cybersecurity
Crafting a Custom Dictionary for Your Password Policy
A custom dictionary is a list of words, phrases, and patterns that users cannot use as passwords. Learn how blocklists fit current NIST SP 800-63B-4 guidance and how to build one in Active Directory and Microsoft 365.
Modern password policies include many components. One important but often overlooked element is the custom dictionary. This is a list of words, phrases, and patterns that users cannot use as passwords.
When implemented correctly, custom dictionaries filter out passwords that look complex on paper but are trivially easy to guess or crack in practice.
Why Standard Password Requirements Are Not Enough
Compromised credentials are one of the leading causes of data breaches. Stolen passwords were the most common way attackers got in for years. Verizon's 2026 Data Breach Investigations Report found that exploited software vulnerabilities have only now overtaken them, and stolen credentials remain one of the top routes into a business.
Attackers exploit weak passwords through credential-based attacks. These target:
- Common patterns and predictable character substitutions.
- Previously breached passwords.
- Industry-specific terms.
The problem is human nature. People gravitate toward passwords that are easy to remember. They use predictable tricks to meet complexity requirements, such as adding a number or symbol to the end of a common word.
A standard Active Directory policy might require eight characters with uppercase, lowercase, numbers, and symbols. Under those rules, passwords like P@$w0rd123 or Letmein1$ all pass technically. Each one is also weak and easily cracked, because they follow patterns found in breached password databases.
This is where a custom dictionary becomes valuable. Rather than relying only on technical requirements, a custom dictionary actively blocks known weak passwords, common phrases, your organization's name, and any terms a targeted attacker would reasonably try first.
Thinking Like an Attacker
Building an effective custom dictionary starts with understanding how attackers approach credential attacks. They use:
- Large databases of previously breached passwords.
- Wordlists that include common terms from specific industries.
- Tools that generate variations of common words using substitution patterns.
A custom dictionary lets defenders anticipate and block those same patterns before they can be exploited.
What NIST Now Recommends
The National Institute of Standards and Technology's current digital identity guidelines, NIST SP 800-63B-4, put a blocklist at the center of password policy. Under those guidelines, a system that checks passwords should:
- Compare every new password against a blocklist of commonly used, expected, or compromised values, and tell the user why a password was rejected.
- Require at least 15 characters when a password is the only sign-in factor, or at least 8 characters when it is used with multi-factor authentication, and allow passwords of at least 64 characters.
- Not impose composition rules, such as requiring a mix of uppercase letters, numbers, and symbols.
- Not require periodic password changes, but force a change when there is evidence a password has been compromised.
- Not use security questions or password hints.
- Allow password managers and autofill, and limit repeated failed sign-in attempts.
In other words, a good custom dictionary is not an extra on top of complexity rules. It replaces them. Length plus a strong blocklist does far more than forcing a symbol onto the end of a common word.
Organizations do not have to build their lists from scratch. Resources like the Have I Been Pwned password list provide a downloadable database of hundreds of millions of previously compromised passwords. This list alone eliminates a large percentage of the weak passwords that would otherwise pass standard complexity checks.
Implementing Custom Dictionaries in Active Directory
If your business uses Microsoft 365, the simplest starting point is Microsoft Entra Password Protection. It automatically applies Microsoft's global banned password list to cloud accounts and lets you add up to 1,000 organization-specific terms, such as your company name, products, and city, to a custom banned list. It also catches common variations, such as swapping "o" for "0" or "a" for "@". With a small agent installed on your domain controllers, the same lists apply to on-premises Active Directory password changes. The custom list and on-premises protection require Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium.
Without that option, implementing a custom password filter in Active Directory traditionally requires a custom password filter DLL. This involves development resources, ongoing maintenance, and careful testing. It is a non-trivial undertaking that presents cost and complexity barriers for many organizations.
Third-party password policy tools simplify this significantly. These tools integrate with native Active Directory password policies and allow administrators to:
- Block billions of known breached passwords.
- Add organization-specific terms.
- Manage multiple custom dictionaries without custom code.
They also support importing existing password files or hash files directly through the interface, making it practical for smaller IT teams to implement a strong custom dictionary policy without specialized development expertise.
A More Complete Approach to Password Security
Custom dictionaries complement a broader password security strategy. They do not replace it. Organizations should also:
- Enforce long passphrases rather than short complex passwords, and drop forced periodic resets unless there is evidence of compromise.
- Encourage a business password manager so every account gets a unique password.
- Implement multi-factor authentication wherever possible, and prefer phishing-resistant methods such as passkeys or FIDO2 security keys for administrators and email.
- Monitor for credential exposure through dark web monitoring services.
Weak passwords remain one of the most exploited vulnerabilities in organizational security. Adding a custom dictionary to your password policy is one of the most direct ways to close that gap.
Need Help Strengthening Your Security Posture?
Cyber One Solutions works with businesses to assess and improve their security at every layer, including identity and access management. Contact us today to schedule a consultation.