Common Password Blacklist Check

Before anyone bothers with brute force, they run a ready-made list of the passwords everybody picks. It is cheap and it works: if yours is password123, qwerty or a football club, length and symbols buy you nothing, because the guess lands within the first few dozen tries. Running your older passwords against a list like this is a fast way to decide which ones to rotate first.

The check lower-cases your input and compares it against a list built into the script, 108 entries covering global classics plus Brazilian favourites such as club names. The tool description mentions a thousand passwords; what actually ships in the code is that smaller sample. On a miss, the string goes through leet normalization (0 to o, 1 to i, 3 to e, 4 to a, at-sign to a, dollar to s) and gets checked again. That is how p@ssw0rd gets flagged.

Matching is exact, so password1234 comes back clean even though it is as guessable as password123. Read a hit as a verdict and a clean result as nothing more than absence from those 108 entries. For a real check, use a Pwned Passwords lookup with k-anonymity, which covers billions of leaked credentials. Whatever you type stays local: the script issues no network request, the list lives inside it.