A method of maintaining a blacklist for gesture-based passwords is provided. A data store of vectors corresponding to gestures is maintained on a blacklist server. Upon receiving a new gesture based password, an electronic device converts the password to a vector and forwards that vector to the blacklist server. The blacklist server assigns the vector to one of a cluster of vectors each having low distance from one another. If the increase in the occurrences of the number of vectors in the cluster results in a blacklist threshold being exceeded, the cluster of vectors is inputted to the blacklist. A notification can be sent back to the electronic device if the forwarded vector is on the blacklist or is inputted to the blacklist.