[macuenca]

We built a "password strengthener" the other day. During the analysis phase, we ran our passwords database (~10M accounts) against a dictionary. We wanted to do this to ban the top ten most common used words among other things. The results beyond top 10 were completely different than the ones pointed here by the OP, the first 10 were almost exactly the same.

My take is that this depends considerably in your target audience, I'm not disclosing which team I'm a member of, but if you run the same analysis to come up with ideas on how to enforce users to chose better passwords, you'll see how different the result are going to look.

[carbocation]

This implies that you're storing plaintext or unsalted hashed passwords, right? What's the use case where this is necessary?