If the problem is that people are using "password" as a password, why not just ban that example specifically? So you can't use "password", but you can use "djwi

If the problem is that people are using "password" as a password, why not just ban that example specifically? So you can't use "password", but you can use "djwipvbs". Assuming you're using bcrypt with an appropriate work factor, wouldn't "djwipvbs" be an acceptable password? More generally, you could ban the top X passwords from those "most frequently use password" lists.