Every organization faces different password risks. With Lithnet Password Protection, you decide which passwords are a risk to you. A broad range of policy options, the freedom to import your own password lists and the ability to block passwords built on common words give you full control of password quality in your organization.
Support plans from USD 750 a year, including 300 usersFree for every organization
New password
Summer2026!
Password rejected
Lithnet Password Protection gives you the flexibility to build a compromised password list from any sources you choose. We provide tooling to import the Have I Been Pwned (HIBP) data set, but you can add any list that your SOC or security partners give you.
Add a word to your banned list and your users can't build a password on it. Password Protection sees through the common substitutions that people use to disguise a word, so if you ban "password", your users can't set "P@ssw0rd", "pa55word!" or "password123456!" either.
You can relax your complexity rules as passwords get longer. For example, you can require a number, a symbol and mixed case in passwords under 13 characters, and drop those requirements at 13 characters or more.
Regular expressions give you the power to define any pattern you need, and to require every new password to match it, or reject any password that does.
Password Protection provides a points-based complexity system, where you can define a flexible policy that assigns points to the use and frequency of different character classes. Users can achieve the complexity requirements in any way that meets the minimum required points.
The NIST password guidelines (SP 800-63B) recommend long passwords that people can remember, checked against a blocklist of common and compromised passwords. They also tell you to stop forcing complexity rules and scheduled password changes on your users. Active Directory can't do that blocklist check on its own, and it's the check that makes the rest of the guidelines safe to adopt.
Password Protection fills that gap by checking every new password against your breached password lists and banned words. Its length-based complexity lets you move your users from complexity rules to passphrases one step at a time. When you're ready to switch off password expiry, the audit shows you which accounts have a compromised password, so you can require a change from just those users.
Apply the NIST password guidelines in Active DirectoryThe Password Protection architecture was built to work in the largest Active Directories in the world. With customers with hundreds of thousands of users, high performance is non-negotiable.
There's no service more important in an organization than its Active Directory. The Password Protection code is built with best practice code safety and extended protections to ensure that nothing ever impacts domain controller operation.
Microsoft Entra Password Protection checks passwords against Microsoft's own global banned list and up to 1,000 terms that you add. The banned list isn't configurable and as such it doesn't include breached password lists such as Have I Been Pwned. With Lithnet Password Protection, you can add your own breached password lists, import whole word lists and set your own length and complexity rules. You can even run both products on the same domain controllers if you choose.
Compare Password Protection and Microsoft Entra Password ProtectionLithnet Password Protection contains built-in support for auditing your existing user accounts for breached passwords. Whenever you add new compromised passwords, you can perform a sweep and be instantly notified if any users need to change their password.
Lithnet Password Protection runs on your domain controllers, and a support plan ensures you have help available directly from Lithnet when you need it. We're there to help troubleshoot problems, provide advice, and ensure you are first to be notified about security fixes.
While the product is open source, support is only provided to those with an active support plan.
From USD 750a year, including up to 300 users
Each additional user is USD 2.50 a year, up to 1,000 users. You can order it online. For more than 1,000 users, we'll send you a quote with tailored pricing when you order.
Yes. Password Protection is free for every organization and has no limits on users or features, however no support is provided by Lithnet. If you run it in production we recommend you purchase a support plan.
Your domain controllers don't need internet access because the filter never connects to the internet. You can download the Have I Been Pwned data on any computer that has internet access. That computer doesn't have to be a domain controller.
It can, but it doesn't have to. You can keep your Active Directory password policy as it is and add the Password Protection checks to it. You can also turn off the complexity requirement in Active Directory and let Password Protection apply its own length-based complexity rules instead. Active Directory still applies settings such as password history.
Any writable domain controller in an Active Directory domain can process a password change, so Password Protection needs to be installed on every one of them to cover every change.
Yes. Microsoft Entra Password Protection installs its own password filter on your domain controllers through an agent that you install there. Active Directory only accepts a new password when every installed password filter accepts it. With both products installed, a password must pass Microsoft's checks and the checks that you set in Lithnet Password Protection. You don't have to choose one or the other.
Support plans start at USD 750 a year, including 300 users. Lithnet Password Protection runs on your domain controllers, and a support plan ensures you have help available directly from Lithnet when you need it. We're there to help troubleshoot problems, provide advice, and ensure you are first to be notified about security fixes.
