Be aware that once you move to 10 character and greater passwords, the value of the external lists is .. kinda debatable, because the number of samples is so many orders of magnitude less. Here’s an example, using the most common 1 million of 10 million leaked passwords:
Based on this data – 883,203 out of the 1 million most common passwords are under 10 characters. That’s 88% of the dataset.
Extrapolating this to 500 million, that means you could discard all but 60 million for the purposes of Discourse, because it’s impossible to have a password under 10 chars. It also ignores sorting, because you probably only want to block passwords that are actually common (repeated).