Password Dictionary Not Preventing Certain Passwords from Being Used

For the Password Dictionary feature, this list shows 10k of the most used passwords. The list contains "password" and "test", yet it does not look like Auth0 is checking if it is included in the user's password.

For example, if the password "test@123445" is used, the password includes the word "test" from the common list, yet it will pass the validation.
 

This article explains this observed behavior.

• Password Dictionary 

Currently, the Password Dictionary feature prevents passwords from being used if they are an exact match of a password in the “10k common passwords” dictionary. The Password Dictionary does not use fuzzy matching enforcement to reject a password that is similar to an entry in the list.

Currently, Auth0 does not have the option to compare partial password matches to the 10k most used passwords list.

If this functionality should be available in a future release of Auth0, please vote for it by giving a thumbs up on this community post.