> The UX of a blacklist with a half billion entries would be so crippling that it would cause a user revolt. The situation doesn't need to get as bad as you th

> The UX of a blacklist with a half billion entries would be so crippling that it would cause a user revolt. The situation doesn't need to get as bad as you think. If you suggest XKCD's four random common word method[1] to your users as part of the user interface, you'll be fine. As a test, I tried putting together 2 random, common, unrelated words together: - yak elephant -> yakelephant - crowd brown -> crowdbrown - plastic envy -> plasticenvy - colon spanish -> colonspanish - jogging adhesive -> joggingadhesive Even with two words, none of the above appear in the Pwned Passwords database of a half a billion passwords. It's not difficult to choose memorable passwords and avoid entries from Pwned Passwords if you suggest this method to your users (preferably recommending four words, but three might be OK depending on the threat model). [1] https://xkcd.com/936/ https://xkcd.com/936/