<p>Hunt thinks that, once a list is as large as his, it is &quot;exceptionally unlikely to have anything outside that collection which is both terrible and actively used.&rdquo; The answer is to check against&nbsp;<a target="_blank" href="https://haveibeenpwned.com/Passwords">the separate Pwned Passwords database</a>, which contains 551 million passwords that have been in one or more of the breaches, using its API. Hunt says he would set a minimum of six characters and then block anything that shows up in Pwned Passwords. One more tip from Hunt: &ldquo;I&rsquo;d block every variation of the company name; nobody on the Acme Corp. website can use AcmeCorp, AcmeCorp1, AcmeC0rp, etc.&rdquo;</p><p>If you want to use the Pwned Passwords API, you can build on one of the many projects already doing so. Typically, they create an environment-native interface to the API, such as with the many PHP libraries, Python and Perl scripts, WordPress plugins, and Java clients, as well as an IFTTT recipe.</p><p>In addition to many weak passwords, Pwned Passwords has a large number of passwords that would satisfy any set of complexity rules, so it might seem to be overkill. But compared with the range of possible passwords, 551 million isn&rsquo;t as big a number as it seems. Nearly all of my own passwords are randomly generated by my password manager, but I tested several passwords I made up on my own in recent years, and none appear in the Pwned Passwords database. So maybe relying on Hunt&rsquo;s API and a minimum length and blocking organization name variants is the easiest route to strong protection.</p>