> For the complete documentation index, see [llms.txt](https://docs.lithnet.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lithnet.io/password-protection/advanced-help/understanding-the-store.md).

# Understanding the store

Lithnet Password Protection can (optionally) test incoming passwords against a compromised password store, as well as a banned word store. The stores are a collection of files that represent a database containing the NTLM hashes. The stores are kept locally, and therefore the filter does not require any internet access to perform compromised password checking.

The stores are created and maintained using [PowerShell](/password-protection/advanced-help/powershell-reference.md).

## Compromised password store

The compromised password store contains the NTLM hashes of exact passwords that you want to prevent your users from using. The most common usage of this store, is to populate it with hashes from the [haveibeenpwned.com](https://haveibeenpwned.com/About) compromised password lists (see the [Sync-HashesFromHibp](/password-protection/advanced-help/powershell-reference/sync-hashesfromhibp.md) PowerShell cmdlet for more details). However, you can also add hashes from other online sources or your own list of bad passwords.

You can add passwords to the store using the [Add‐CompromisedPassword](/password-protection/advanced-help/powershell-reference/add-compromisedpassword.md), [Import‐CompromisedPasswords](/password-protection/advanced-help/powershell-reference/import-compromisedpasswords.md) and [Import‐CompromisedPasswordHashes](/password-protection/advanced-help/powershell-reference/import-compromisedpasswordhashes.md) cmdlets.

## Banned word store

While the breach password store provides an effective way of making sure known compromised passwords are not used, it doesn't protect against bad passwords that have not yet been compromised. For example, a very common password is `WinterXXXX` where XXXX is the year the user set the password. While `Winter2018` may be in the compromised password store, `Winter2020` may not be, until it's detected in password breach. The banned word store allow you to specify words that a password should never be based on. It does this by applying [normalization rules](/password-protection/advanced-help/normalization-rules.md) against the incoming password, and then looking for a match in the banned word store. By applying the normalization rules against `Winter2020`, it would be converted to `winter`, which would then be checked against the store.

Another common pattern that users employ when selecting passwords, is to base it on the company name. If you were to add `lithnet` to the banned word store, you could prevent the usage of passwords based on that such as `L!thnet`, `Lithnet123`, etc.

You can add passwords to the store using the [Add‐BannedWord](/password-protection/advanced-help/powershell-reference/add-bannedword.md), [Import‐BannedWords](/password-protection/advanced-help/powershell-reference/import-bannedwords.md) and [Import‐BannedWordHashes](/password-protection/advanced-help/powershell-reference/import-bannedwordhashes.md) cmdlets.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.lithnet.io/password-protection/advanced-help/understanding-the-store.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.