passwords

Overview ¶

Package passwords exposes the embedded common-password blocklist used at signup and password-reset to reject the most-prevalent passwords.

Source: SecLists 10k-most-common (descended from leaked-credential corpora; widely used by HIBP-aligned tooling). The cutoff at 10k is a pragmatic balance: blocks the high-prevalence head of the distribution without bloating the binary or pushing legitimate, hard-to-guess passwords into a false-positive tail.

To refresh the list, replace internal/passwords/common_passwords.txt with a new SecLists snapshot and re-run the test suite.